diff options
Diffstat (limited to 'buglist.cgi')
| -rwxr-xr-x | buglist.cgi | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/buglist.cgi b/buglist.cgi index 7b513e607..ca51e6243 100755 --- a/buglist.cgi +++ b/buglist.cgi @@ -228,7 +228,9 @@ sub LookupNamedQuery { $query->url || ThrowUserError("buglist_parameters_required"); - return wantarray ? ($query->url, $query->id) : $query->url; + # Detaint $sharer_id. + $sharer_id = $query->user->id if $sharer_id; + return wantarray ? ($query->url, $query->id, $sharer_id) : $query->url; } # Inserts a Named Query (a "Saved Search") into the database, or @@ -347,6 +349,7 @@ sub _close_standby_message { my $cmdtype = $cgi->param('cmdtype') || ''; my $remaction = $cgi->param('remaction') || ''; +my $sharer_id; # Backwards-compatibility - the old interface had cmdtype="runnamed" to run # a named command, and we can't break this because it's in bookmarks. @@ -383,8 +386,9 @@ $filename =~ s/"/\\"/g; # escape quotes if ($cmdtype eq "dorem") { if ($remaction eq "run") { my $query_id; - ($buffer, $query_id) = LookupNamedQuery(scalar $cgi->param("namedcmd"), - scalar $cgi->param('sharer_id')); + ($buffer, $query_id, $sharer_id) = + LookupNamedQuery(scalar $cgi->param("namedcmd"), + scalar $cgi->param('sharer_id')); # If this is the user's own query, remember information about it # so that it can be modified easily. $vars->{'searchname'} = $cgi->param('namedcmd'); @@ -774,7 +778,8 @@ if ($format->{'extension'} eq 'html' && !defined $params->param('limit')) { # Generate the basic SQL query that will be used to generate the bug list. my $search = new Bugzilla::Search('fields' => \@selectcolumns, 'params' => scalar $params->Vars, - 'order' => \@orderstrings); + 'order' => \@orderstrings, + 'sharer' => $sharer_id); my $query = $search->sql; $vars->{'search_description'} = $search->search_description; |