diff options
| author | Simon Green <sgreen@redhat.com> | 2013-02-19 18:14:59 +0100 |
|---|---|---|
| committer | Frédéric Buclin <LpSolit@gmail.com> | 2013-02-19 18:14:59 +0100 |
| commit | 0bd4c361b4a5fe0e0773e77571a84234b8f91f76 (patch) | |
| tree | 4cd125aa182bc215c61dca04f06054a0786e7fa5 /report.cgi | |
| parent | 7e4fb28341abfe2a5c31645e20c5804229e8eaea (diff) | |
| download | bugzilla-0bd4c361b4a5fe0e0773e77571a84234b8f91f76.tar.gz bugzilla-0bd4c361b4a5fe0e0773e77571a84234b8f91f76.tar.xz | |
Bug 824399: (CVE-2013-0786) [SECURITY] build_subselect() leaks the existence of products and components you cannot access
r/a=LpSolit
Diffstat (limited to 'report.cgi')
| -rwxr-xr-x | report.cgi | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/report.cgi b/report.cgi index 5d5033b7d..7bff62be9 100755 --- a/report.cgi +++ b/report.cgi @@ -226,7 +226,13 @@ $vars->{'width'} = $width if $width; $vars->{'height'} = $height if $height; $vars->{'query'} = $query; -$vars->{'debug'} = $cgi->param('debug'); + +if ($cgi->param('debug') + && Bugzilla->params->{debug_group} + && Bugzilla->user->in_group(Bugzilla->params->{debug_group}) +) { + $vars->{'debug'} = 1; +} if ($action eq "wrap") { # So which template are we using? If action is "wrap", we will be using |