From eb1357fe03bb47cdd479cf533022e11dd6bd22e0 Mon Sep 17 00:00:00 2001
From: Dylan Hardison <dylan@mozilla.com>
Date: Tue, 22 Dec 2015 12:11:21 -0500
Subject: Bug 1230932 - Providing a condition as an ID to the webservice
 results in a taint error r=dkl,a=dkl

---
 Bugzilla/WebService/Bug.pm | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'Bugzilla/WebService/Bug.pm')

diff --git a/Bugzilla/WebService/Bug.pm b/Bugzilla/WebService/Bug.pm
index 84f209347..75a0aab0e 100644
--- a/Bugzilla/WebService/Bug.pm
+++ b/Bugzilla/WebService/Bug.pm
@@ -1200,6 +1200,10 @@ sub update_comment_tags {
                           { function => 'Bug.update_comment_tags',
                             param    => 'comment_id' });
 
+    ThrowCodeError("param_integer_required", { function => 'Bug.update_comment_tags',
+                                               param => 'comment_id' })
+      unless $comment_id =~ /^[0-9]+$/;
+
     my $comment = Bugzilla::Comment->new($comment_id)
         || return [];
     $comment->bug->check_is_visible();
-- 
cgit v1.2.3-24-g4f1b