summaryrefslogtreecommitdiffstats
path: root/extensions
diff options
context:
space:
mode:
Diffstat (limited to 'extensions')
-rw-r--r--extensions/ComponentWatching/Extension.pm7
-rw-r--r--extensions/ComponentWatching/template/en/default/hook/global/code-error-errors.html.tmpl12
2 files changed, 16 insertions, 3 deletions
diff --git a/extensions/ComponentWatching/Extension.pm b/extensions/ComponentWatching/Extension.pm
index 318de5e1a..a56b46249 100644
--- a/extensions/ComponentWatching/Extension.pm
+++ b/extensions/ComponentWatching/Extension.pm
@@ -14,7 +14,7 @@ use Bugzilla::Error;
use Bugzilla::Group;
use Bugzilla::User;
use Bugzilla::User::Setting;
-use Bugzilla::Util qw(trim trick_taint);
+use Bugzilla::Util qw(detaint_natural trim trick_taint);
our $VERSION = '2';
@@ -611,8 +611,9 @@ sub _deleteWatch {
my ($user, $id) = @_;
my $dbh = Bugzilla->dbh;
- trick_taint($id);
- $dbh->do("DELETE FROM component_watch WHERE id=?", undef, $id);
+ detaint_natural($id) || ThrowCodeError("component_watch_invalid_id");
+ $dbh->do("DELETE FROM component_watch WHERE id=? AND user_id=?",
+ undef, $id, $user->id);
}
sub _addDefaultSettings {
diff --git a/extensions/ComponentWatching/template/en/default/hook/global/code-error-errors.html.tmpl b/extensions/ComponentWatching/template/en/default/hook/global/code-error-errors.html.tmpl
new file mode 100644
index 000000000..04640afef
--- /dev/null
+++ b/extensions/ComponentWatching/template/en/default/hook/global/code-error-errors.html.tmpl
@@ -0,0 +1,12 @@
+[%# This Source Code Form is subject to the terms of the Mozilla Public
+ # License, v. 2.0. If a copy of the MPL was not distributed with this
+ # file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ #
+ # This Source Code Form is "Incompatible With Secondary Licenses", as
+ # defined by the Mozilla Public License, v. 2.0.
+ #%]
+
+[% IF error == "component_watch_invalid_id" %]
+ [% title = "Invalid Component Watch ID" %]
+ The component watch id provided is invalid.
+[% END %]