summaryrefslogtreecommitdiffstats
path: root/template/en/default
diff options
context:
space:
mode:
authorbugreport%peshkin.net <>2005-10-20 05:07:00 +0200
committerbugreport%peshkin.net <>2005-10-20 05:07:00 +0200
commita38539a73699a6d03c6d129375cecde85267269a (patch)
treeb76109ec212c37e3d396d7f8df7136c19bdb61c3 /template/en/default
parent22212e5112de8a21d1727a0ea090a8a37253751b (diff)
downloadbugzilla-a38539a73699a6d03c6d129375cecde85267269a.tar.gz
bugzilla-a38539a73699a6d03c6d129375cecde85267269a.tar.xz
Bug 312933 Query.cgi leaks product names
Patch by Joel Peshkin <bugreport@peshkin.net> r=lpsolit, a=justdave
Diffstat (limited to 'template/en/default')
-rw-r--r--template/en/default/search/form.html.tmpl8
1 files changed, 7 insertions, 1 deletions
diff --git a/template/en/default/search/form.html.tmpl b/template/en/default/search/form.html.tmpl
index 80bf0a2b9..7d061b2ae 100644
--- a/template/en/default/search/form.html.tmpl
+++ b/template/en/default/search/form.html.tmpl
@@ -43,7 +43,13 @@ var tms = new Array();
[% nclass = 0 %]
[% FOREACH c = classification %]
prods[[% nclass FILTER js %]] = [
- [%- FOREACH item = c.products %]'[% item.name FILTER js %]'[% ", " UNLESS loop.last %] [%- END -%] ];
+ [% sep = '' %]
+ [%- FOREACH item = c.products -%]
+ [%- IF user.can_see_product(item.name) -%]
+ [%- sep FILTER js %]'[% item.name FILTER js %]'
+ [%- sep = ',' -%]
+ [%- END -%]
+ [%- END -%] ];
[% nclass = nclass+1 %]
[% END %]