From 19b514899d02fde1c53916fe0c0a364548c6ab8d Mon Sep 17 00:00:00 2001
From: Reed Loden <reed@reedloden.com>
Date: Tue, 29 May 2012 07:50:08 -0700
Subject: Bug 754673 - CSRF vulnerability in query.cgi allows possible
 unauthorized use of "Set my default search back to the system default"
 [r=LpSolit a=LpSolit]

---
 query.cgi                                 | 3 +++
 template/en/default/search/knob.html.tmpl | 3 ++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/query.cgi b/query.cgi
index 47be93125..df3d9cadf 100755
--- a/query.cgi
+++ b/query.cgi
@@ -20,6 +20,7 @@ use Bugzilla::Product;
 use Bugzilla::Keyword;
 use Bugzilla::Field;
 use Bugzilla::Install::Util qw(vers_cmp);
+use Bugzilla::Token;
 
 ###############
 # Subroutines #
@@ -72,6 +73,8 @@ my $userid = $user->id;
 
 if ($cgi->param('nukedefaultquery')) {
     if ($userid) {
+        my $token = $cgi->param('token');
+        check_hash_token($token, ['nukedefaultquery']);
         $dbh->do("DELETE FROM namedqueries" .
                  " WHERE userid = ? AND name = ?", 
                  undef, ($userid, DEFAULT_QUERY_NAME));
diff --git a/template/en/default/search/knob.html.tmpl b/template/en/default/search/knob.html.tmpl
index 78479e7bf..723825a3c 100644
--- a/template/en/default/search/knob.html.tmpl
+++ b/template/en/default/search/knob.html.tmpl
@@ -62,7 +62,8 @@
         
 [% IF userdefaultquery %]
   <p>
-    <a href="query.cgi?nukedefaultquery=1">
+    <a href="query.cgi?nukedefaultquery=1&amp;token=
+       [%- issue_hash_token(['nukedefaultquery']) FILTER uri %]">
       Set my default search back to the system default</a>.
   </p>
 [% END %]
-- 
cgit v1.2.3-24-g4f1b