diff options
| author | justdave%syndicomm.com <> | 2002-01-20 10:44:34 +0100 |
|---|---|---|
| committer | justdave%syndicomm.com <> | 2002-01-20 10:44:34 +0100 |
| commit | 4e6767d4c3d1b0b583f4ec076992345545294748 (patch) | |
| tree | 44d10a299f4d910400fb420b38e21e769c00be7e /showvotes.cgi | |
| parent | 72f340e3a12668c9356102c71f864afa986e001a (diff) | |
| download | bugzilla-4e6767d4c3d1b0b583f4ec076992345545294748.tar.gz bugzilla-4e6767d4c3d1b0b583f4ec076992345545294748.tar.xz | |
Fix for bug 108982: enable taint mode for all user-facing CGI files.
Patch by Brad Baetz <bbaetz@student.usyd.edu.au>
r= jake, justdave
Diffstat (limited to 'showvotes.cgi')
| -rwxr-xr-x | showvotes.cgi | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/showvotes.cgi b/showvotes.cgi index a6928bf84..6ed4bb8e4 100755 --- a/showvotes.cgi +++ b/showvotes.cgi @@ -1,4 +1,4 @@ -#!/usr/bonsaitools/bin/perl -w +#!/usr/bonsaitools/bin/perl -wT # -*- Mode: perl; indent-tabs-mode: nil -*- # # The contents of this file are subject to the Mozilla Public @@ -25,6 +25,8 @@ use diagnostics; use strict; +use lib qw(.); + require "CGI.pl"; ConnectToDatabase(); @@ -61,7 +63,7 @@ if (defined $::FORM{'voteon'}) { # Make sure the user ID is a positive integer representing an existing user. if (defined $::FORM{'user'}) { - $::FORM{'user'} =~ /^([1-9][0-9]*)$/ + detaint_natural($::FORM{'user'}) || DisplayError("The user number is invalid.") && exit; SendSQL("SELECT 1 FROM profiles WHERE userid = $::FORM{'user'}"); |