summaryrefslogtreecommitdiffstats
path: root/report.cgi
diff options
context:
space:
mode:
authorSimon Green <sgreen@redhat.com>2013-02-19 18:11:40 +0100
committerFrédéric Buclin <LpSolit@gmail.com>2013-02-19 18:11:40 +0100
commite2c8da0dfc534ffca6232cc7d370299d5d446604 (patch)
tree94031fcc7203f315398ddb7d3055908769e99294 /report.cgi
parentfab1e128fd61a78809ee967279e8acc6b6962f1e (diff)
downloadbugzilla-e2c8da0dfc534ffca6232cc7d370299d5d446604.tar.gz
bugzilla-e2c8da0dfc534ffca6232cc7d370299d5d446604.tar.xz
Bug 824399: (CVE-2013-0786) [SECURITY] build_subselect() leaks the existence of products and components you cannot access
r/a=LpSolit
Diffstat (limited to 'report.cgi')
-rwxr-xr-xreport.cgi8
1 files changed, 7 insertions, 1 deletions
diff --git a/report.cgi b/report.cgi
index 2949a18c3..5e51bd34a 100755
--- a/report.cgi
+++ b/report.cgi
@@ -258,7 +258,13 @@ $vars->{'width'} = $width;
$vars->{'height'} = $height;
$vars->{'queries'} = $extra_data;
$vars->{'saved_report_id'} = $cgi->param('saved_report_id');
-$vars->{'debug'} = $cgi->param('debug');
+
+if ($cgi->param('debug')
+ && Bugzilla->params->{debug_group}
+ && Bugzilla->user->in_group(Bugzilla->params->{debug_group})
+) {
+ $vars->{'debug'} = 1;
+}
if ($action eq "wrap") {
# So which template are we using? If action is "wrap", we will be using