summaryrefslogtreecommitdiffstats
path: root/template
diff options
context:
space:
mode:
authorFrédéric Buclin <LpSolit@gmail.com>2012-07-26 23:04:08 +0200
committerFrédéric Buclin <LpSolit@gmail.com>2012-07-26 23:04:08 +0200
commit42565b85b31129431c6087413bc196a7bf601c9f (patch)
treed931d0993925932b4a6cce1bc5a3508ef3c2e2b2 /template
parent9076d41e60406366a7d9476dda6d137416b07c2d (diff)
downloadbugzilla-42565b85b31129431c6087413bc196a7bf601c9f.tar.gz
bugzilla-42565b85b31129431c6087413bc196a7bf601c9f.tar.xz
Bug 777398: (CVE-2012-1968) [SECURITY] HTML bugmail exposes information about restricted bugs
r=glob a=LpSolit
Diffstat (limited to 'template')
-rw-r--r--template/en/default/email/bugmail.html.tmpl21
1 files changed, 11 insertions, 10 deletions
diff --git a/template/en/default/email/bugmail.html.tmpl b/template/en/default/email/bugmail.html.tmpl
index f8f182548..d52fe6306 100644
--- a/template/en/default/email/bugmail.html.tmpl
+++ b/template/en/default/email/bugmail.html.tmpl
@@ -31,12 +31,12 @@
[% FOREACH comment = new_comments.reverse %]
<div>
[% IF comment.count %]
- <b>[% "Comment # ${comment.count}" FILTER bug_link( bug,
- {comment_num => comment.count, full_url => 1}) FILTER none %]
- on [% "$terms.bug $bug.id" FILTER bug_link( bug, { full_url => 1 }) FILTER none %]
+ <b>[% "Comment # ${comment.count}" FILTER bug_link(bug,
+ {comment_num => comment.count, full_url => 1, user => to_user}) FILTER none %]
+ on [% "$terms.bug $bug.id" FILTER bug_link(bug, { full_url => 1, user => to_user }) FILTER none %]
from [% INCLUDE global/user.html.tmpl who = comment.author %]</b>
[% END %]
- <pre>[% comment.body_full({ wrap => 1 }) FILTER quoteUrls(bug, comment) %]</pre>
+ <pre>[% comment.body_full({ wrap => 1 }) FILTER quoteUrls(bug, comment, to_user) %]</pre>
</div>
[% END %]
</p>
@@ -69,13 +69,14 @@
[% SET in_table = 0 %]
[% END %]
[% IF change.blocker %]
- [% "${terms.Bug} ${bug.id}" FILTER bug_link(bug, full_url => 1) FILTER none %] depends
- on [% "${terms.bug} ${change.blocker.id}"
- FILTER bug_link(change.blocker, full_url => 1) FILTER none %],
+ [% "${terms.Bug} ${bug.id}" FILTER bug_link(bug, {full_url => 1, user => to_user}) FILTER none %]
+ depends on
+ [%+ "${terms.bug} ${change.blocker.id}"
+ FILTER bug_link(change.blocker, {full_url => 1, user => to_user}) FILTER none %],
which changed state.
[% ELSE %]
- [% INCLUDE global/user.html.tmpl who = change.who %]
- changed [% "${terms.Bug} ${bug.id}" FILTER bug_link(bug, full_url => 1) FILTER none %]
+ [% INCLUDE global/user.html.tmpl who = change.who %] changed
+ [%+ "${terms.bug} ${bug.id}" FILTER bug_link(bug, {full_url => 1, user => to_user}) FILTER none %]
[% END %]
<br>
[% IF in_table == 0 %]
@@ -99,7 +100,7 @@
<th>[% field_label FILTER html %]</th>
<td>
[% IF change.field_name == "bug_id" %]
- [% new_value FILTER bug_link(bug, full_url => 1) FILTER none %]
+ [% new_value FILTER bug_link(bug, {full_url => 1, user => to_user}) FILTER none %]
[% ELSE %]
[% new_value FILTER html %]
[% END %]