From a8cc91bfe25645ff5d83d1732109533688872196 Mon Sep 17 00:00:00 2001
From: "lpsolit%gmail.com" <>
Date: Sun, 4 Jan 2009 23:15:28 +0000
Subject: Bug 471866: Classification name length and sortkey max value not
 validated - Patch by Frédéric Buclin <LpSolit@gmail.com> r=wicked a=LpSolit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Bugzilla/Classification.pm | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

(limited to 'Bugzilla/Classification.pm')

diff --git a/Bugzilla/Classification.pm b/Bugzilla/Classification.pm
index 7c362bc45..a7f59b4bb 100644
--- a/Bugzilla/Classification.pm
+++ b/Bugzilla/Classification.pm
@@ -19,6 +19,7 @@ use strict;
 
 package Bugzilla::Classification;
 
+use Bugzilla::Constants;
 use Bugzilla::Util;
 use Bugzilla::Error;
 use Bugzilla::Product;
@@ -85,6 +86,10 @@ sub _check_name {
     $name = trim($name);
     $name || ThrowUserError('classification_not_specified');
 
+    if (length($name) > MAX_CLASSIFICATION_SIZE) {
+        ThrowUserError('classification_name_too_long', {'name' => $name});
+    }
+
     my $classification = new Bugzilla::Classification({name => $name});
     if ($classification && (!ref $invocant || $classification->id != $invocant->id)) {
         ThrowUserError("classification_already_exists", { name => $classification->name });
@@ -104,9 +109,9 @@ sub _check_sortkey {
 
     $sortkey ||= 0;
     my $stored_sortkey = $sortkey;
-    detaint_natural($sortkey)
-      || ThrowUserError('classification_invalid_sortkey', { 'sortkey' => $stored_sortkey });
-
+    if (!detaint_natural($sortkey) || $sortkey > MAX_SMALLINT) {
+        ThrowUserError('classification_invalid_sortkey', { 'sortkey' => $stored_sortkey });
+    }
     return $sortkey;
 }
 
-- 
cgit v1.2.3-24-g4f1b