From a748745d3eb9110b0c6bcd803d8d86db8951ad43 Mon Sep 17 00:00:00 2001
From: Byron Jones <glob@mozilla.com>
Date: Tue, 27 Jan 2015 11:47:42 +0800
Subject: Bug 1124437: Backport upstream bug 1090275 to bmo/4.2 to whitelist
 webservice api methods

---
 Bugzilla/WebService/Server/JSONRPC.pm | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'Bugzilla/WebService/Server/JSONRPC.pm')

diff --git a/Bugzilla/WebService/Server/JSONRPC.pm b/Bugzilla/WebService/Server/JSONRPC.pm
index 0df4240e0..b0928960b 100644
--- a/Bugzilla/WebService/Server/JSONRPC.pm
+++ b/Bugzilla/WebService/Server/JSONRPC.pm
@@ -42,6 +42,7 @@ use Bugzilla::Util;
 
 use HTTP::Message;
 use MIME::Base64 qw(decode_base64 encode_base64);
+use List::MoreUtils qw(none);
 
 #####################################
 # Public JSON::RPC Method Overrides #
@@ -415,6 +416,11 @@ sub _argument_type_check {
         }
     }
 
+    # Only allowed methods to be used from our whitelist
+    if (none { $_ eq $method} $pkg->PUBLIC_METHODS) {
+        ThrowCodeError('unknown_method', { method => $self->_bz_method_name });
+    }
+
     # This is the best time to do login checks.
     $self->handle_login();
 
-- 
cgit v1.2.3-24-g4f1b