diff options
| author | David Lawrence <dkl@mozilla.com> | 2015-08-06 06:21:33 +0200 |
|---|---|---|
| committer | Byron Jones <glob@mozilla.com> | 2015-08-06 06:21:33 +0200 |
| commit | 86a7f0140f898cd77e5d3a2dcfd52722d2f65089 (patch) | |
| tree | 183c401743b3eae9a26d249804072df6e9f55db9 /extensions/ComponentWatching/Extension.pm | |
| parent | 9465a77fad2f80e4e3615b0aa0af36bc5da11122 (diff) | |
| download | bugzilla-86a7f0140f898cd77e5d3a2dcfd52722d2f65089.tar.gz bugzilla-86a7f0140f898cd77e5d3a2dcfd52722d2f65089.tar.xz | |
Bug 1191565 - [Security] Able to delete any Bugzilla user's component watching
Diffstat (limited to 'extensions/ComponentWatching/Extension.pm')
| -rw-r--r-- | extensions/ComponentWatching/Extension.pm | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/extensions/ComponentWatching/Extension.pm b/extensions/ComponentWatching/Extension.pm index 318de5e1a..a56b46249 100644 --- a/extensions/ComponentWatching/Extension.pm +++ b/extensions/ComponentWatching/Extension.pm @@ -14,7 +14,7 @@ use Bugzilla::Error; use Bugzilla::Group; use Bugzilla::User; use Bugzilla::User::Setting; -use Bugzilla::Util qw(trim trick_taint); +use Bugzilla::Util qw(detaint_natural trim trick_taint); our $VERSION = '2'; @@ -611,8 +611,9 @@ sub _deleteWatch { my ($user, $id) = @_; my $dbh = Bugzilla->dbh; - trick_taint($id); - $dbh->do("DELETE FROM component_watch WHERE id=?", undef, $id); + detaint_natural($id) || ThrowCodeError("component_watch_invalid_id"); + $dbh->do("DELETE FROM component_watch WHERE id=? AND user_id=?", + undef, $id, $user->id); } sub _addDefaultSettings { |