summaryrefslogtreecommitdiffstats
path: root/Bugzilla
diff options
context:
space:
mode:
Diffstat (limited to 'Bugzilla')
-rw-r--r--Bugzilla/FlagType.pm8
1 files changed, 5 insertions, 3 deletions
diff --git a/Bugzilla/FlagType.pm b/Bugzilla/FlagType.pm
index b5bbbc87b..6b3b7d15c 100644
--- a/Bugzilla/FlagType.pm
+++ b/Bugzilla/FlagType.pm
@@ -461,14 +461,16 @@ sub sqlify_criteria {
my @criteria = ("1=1");
if ($criteria->{name}) {
- push(@criteria, "flagtypes.name = " . $dbh->quote($criteria->{name}));
+ my $name = $dbh->quote($criteria->{name});
+ trick_taint($name); # Detaint data as we have quoted it.
+ push(@criteria, "flagtypes.name = $name");
}
if ($criteria->{target_type}) {
# The target type is stored in the database as a one-character string
# ("a" for attachment and "b" for bug), but this function takes complete
# names ("attachment" and "bug") for clarity, so we must convert them.
- my $target_type = $dbh->quote(substr($criteria->{target_type}, 0, 1));
- push(@criteria, "flagtypes.target_type = $target_type");
+ my $target_type = $criteria->{target_type} eq 'bug'? 'b' : 'a';
+ push(@criteria, "flagtypes.target_type = '$target_type'");
}
if (exists($criteria->{is_active})) {
my $is_active = $criteria->{is_active} ? "1" : "0";