summaryrefslogtreecommitdiffstats
path: root/template/en/default/reports
diff options
context:
space:
mode:
authorSimon Green <sgreen@redhat.com>2014-10-06 17:04:40 +0200
committerDavid Lawrence <dkl@mozilla.com>2014-10-06 17:04:40 +0200
commit10e40c5707d383303c7837f526c3ab06466ede98 (patch)
tree94f4876bbbc7442d61f74938190c7bfdfac13e45 /template/en/default/reports
parentfa954ab78cc60aba43aedb85e2b4f98d56d7bf9d (diff)
downloadbugzilla-10e40c5707d383303c7837f526c3ab06466ede98.tar.gz
bugzilla-10e40c5707d383303c7837f526c3ab06466ede98.tar.xz
Bug 1054702: CSV export vulnerable to formulae injection
r=glob,a=glob
Diffstat (limited to 'template/en/default/reports')
-rw-r--r--template/en/default/reports/report-table.csv.tmpl8
1 files changed, 5 insertions, 3 deletions
diff --git a/template/en/default/reports/report-table.csv.tmpl b/template/en/default/reports/report-table.csv.tmpl
index e2a92b51d..e94014b92 100644
--- a/template/en/default/reports/report-table.csv.tmpl
+++ b/template/en/default/reports/report-table.csv.tmpl
@@ -23,11 +23,13 @@
[% END %]
[% tbl_field_disp FILTER csv %]: [% tbl_disp FILTER csv %]
[% END %]
-[% IF row_field %]
+[% IF row_field && col_field %]
+ [% row_field_disp _ ' / ' _ col_field_disp FILTER csv %]
+[% ELSIF row_field %]
[% row_field_disp FILTER csv %]
+[% ELSE %]
+ [% col_field_disp FILTER csv %]
[% END %]
-[% " / " IF col_field AND row_field %]
-[% col_field_disp FILTER csv %]
[% IF col_field -%]
[% FOREACH col = col_names -%]
[% colsepchar %]