From a224dfe5f7c3d54d9d0ad8e521f799414b7386b8 Mon Sep 17 00:00:00 2001 From: "lpsolit%gmail.com" <> Date: Mon, 19 Dec 2005 03:13:00 +0000 Subject: Bug 319082: "new Bugzilla::User($uid)" allows you to pass invalid $uid - Patch by Frédéric Buclin r=mkanat a=justdave MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Bugzilla/User.pm | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) (limited to 'Bugzilla/User.pm') diff --git a/Bugzilla/User.pm b/Bugzilla/User.pm index 9f6c415ef..fe46dc292 100644 --- a/Bugzilla/User.pm +++ b/Bugzilla/User.pm @@ -69,10 +69,20 @@ use constant MATCH_SKIP_CONFIRM => 1; sub new { my $invocant = shift; - if (scalar @_ == 0) { + my $user_id = shift; + + if ($user_id) { + my $uid = $user_id; + detaint_natural($user_id) + || ThrowCodeError('invalid_numeric_argument', + {argument => 'userID', + value => $uid, + function => 'Bugzilla::User::new'}); + return $invocant->_create("userid=?", $user_id); + } + else { return $invocant->_create; } - return $invocant->_create("userid=?", @_); } # This routine is sort of evil. Nothing except the login stuff should @@ -85,8 +95,10 @@ sub new { # in the id its already had to validate (or the User.pm object, of course) sub new_from_login { my $invocant = shift; + my $login = shift; + my $dbh = Bugzilla->dbh; - return $invocant->_create($dbh->sql_istrcmp('login_name', '?'), @_); + return $invocant->_create($dbh->sql_istrcmp('login_name', '?'), $login); } # Internal helper for the above |new| methods -- cgit v1.2.3-24-g4f1b