diff options
| author | Simon Green <sgreen@redhat.com> | 2013-02-19 18:11:40 +0100 |
|---|---|---|
| committer | Frédéric Buclin <LpSolit@gmail.com> | 2013-02-19 18:11:40 +0100 |
| commit | e2c8da0dfc534ffca6232cc7d370299d5d446604 (patch) | |
| tree | 94031fcc7203f315398ddb7d3055908769e99294 /report.cgi | |
| parent | fab1e128fd61a78809ee967279e8acc6b6962f1e (diff) | |
| download | bugzilla-e2c8da0dfc534ffca6232cc7d370299d5d446604.tar.gz bugzilla-e2c8da0dfc534ffca6232cc7d370299d5d446604.tar.xz | |
Bug 824399: (CVE-2013-0786) [SECURITY] build_subselect() leaks the existence of products and components you cannot access
r/a=LpSolit
Diffstat (limited to 'report.cgi')
| -rwxr-xr-x | report.cgi | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/report.cgi b/report.cgi index 2949a18c3..5e51bd34a 100755 --- a/report.cgi +++ b/report.cgi @@ -258,7 +258,13 @@ $vars->{'width'} = $width; $vars->{'height'} = $height; $vars->{'queries'} = $extra_data; $vars->{'saved_report_id'} = $cgi->param('saved_report_id'); -$vars->{'debug'} = $cgi->param('debug'); + +if ($cgi->param('debug') + && Bugzilla->params->{debug_group} + && Bugzilla->user->in_group(Bugzilla->params->{debug_group}) +) { + $vars->{'debug'} = 1; +} if ($action eq "wrap") { # So which template are we using? If action is "wrap", we will be using |