diff options
| author | myk%mozilla.org <> | 2002-07-07 03:27:18 +0200 |
|---|---|---|
| committer | myk%mozilla.org <> | 2002-07-07 03:27:18 +0200 |
| commit | 38fac1759c2ebcd108d5fa2dbc86d0b34e0f2951 (patch) | |
| tree | 9c6a4f75d1aa1570bf6d2c89ea0fffcf99c29a65 /CGI.pl | |
| parent | ef7c3883b5b4f8ef385f7d2d935c8ae3990e6249 (diff) | |
| download | bugzilla-38fac1759c2ebcd108d5fa2dbc86d0b34e0f2951.tar.gz bugzilla-38fac1759c2ebcd108d5fa2dbc86d0b34e0f2951.tar.xz | |
Fix for bug 155700: detaints bug ID in ValidateBugID so it doesn't fail taint checks.
2rx=bbaetz
Diffstat (limited to 'CGI.pl')
| -rw-r--r-- | CGI.pl | 5 |
1 files changed, 3 insertions, 2 deletions
@@ -276,8 +276,9 @@ sub ValidateBugID { $id = trim($id); # If the ID isn't a number, it might be an alias, so try to convert it. - if ($id !~ /^[1-9][0-9]*$/) { - $id = BugAliasToID($id); + my $alias = $id; + if (!detaint_natural($id)) { + $id = BugAliasToID($alias); if (!$id) { my $html_id = html_quote($_[0]); my $alias_specific_message = Param("usebugaliases") ? |