Bug 1191565 - [Security] Able to delete any Bugzilla user's component watching

2 files changed, 16 insertions, 3 deletions

diff --git a/extensions/ComponentWatching/Extension.pm b/extensions/ComponentWatching/Extension.pm
index 318de5e1a..a56b46249 100644
--- a/extensions/ComponentWatching/Extension.pm
+++ b/extensions/ComponentWatching/Extension.pm
@@ -14,7 +14,7 @@ use Bugzilla::Error;
 use Bugzilla::Group;
 use Bugzilla::User;
 use Bugzilla::User::Setting;
-use Bugzilla::Util qw(trim trick_taint);
+use Bugzilla::Util qw(detaint_natural trim trick_taint);
 
 our $VERSION = '2';
 
@@ -611,8 +611,9 @@ sub _deleteWatch {
     my ($user, $id) = @_;
     my $dbh = Bugzilla->dbh;
 
-    trick_taint($id);
-    $dbh->do("DELETE FROM component_watch WHERE id=?", undef, $id);
+    detaint_natural($id) || ThrowCodeError("component_watch_invalid_id");
+    $dbh->do("DELETE FROM component_watch WHERE id=? AND user_id=?",
+             undef, $id, $user->id);
 }
 
 sub _addDefaultSettings {
diff --git a/extensions/ComponentWatching/template/en/default/hook/global/code-error-errors.html.tmpl b/extensions/ComponentWatching/template/en/default/hook/global/code-error-errors.html.tmpl
new file mode 100644
index 000000000..04640afef
--- /dev/null
+++ b/extensions/ComponentWatching/template/en/default/hook/global/code-error-errors.html.tmpl
@@ -0,0 +1,12 @@
+[%# This Source Code Form is subject to the terms of the Mozilla Public
+  # License, v. 2.0. If a copy of the MPL was not distributed with this
+  # file, You can obtain one at http://mozilla.org/MPL/2.0/.
+  #
+  # This Source Code Form is "Incompatible With Secondary Licenses", as
+  # defined by the Mozilla Public License, v. 2.0.
+  #%]
+
+[% IF error == "component_watch_invalid_id" %]
+   [% title = "Invalid Component Watch ID" %]
+   The component watch id provided is invalid.
+[% END %]