From 9e044b55c14320849fec284fa5452e9385153ec4 Mon Sep 17 00:00:00 2001
From: Frédéric Buclin <LpSolit@gmail.com>
Date: Thu, 18 Feb 2010 01:13:43 +0100
Subject: Bug 533018: "Confirm match" displays full email address to logged-out
 users in request.cgi r/a=mkanat

---
 Bugzilla/User.pm | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'Bugzilla')

diff --git a/Bugzilla/User.pm b/Bugzilla/User.pm
index 240fcfcdb..7dd86f301 100644
--- a/Bugzilla/User.pm
+++ b/Bugzilla/User.pm
@@ -1066,7 +1066,8 @@ sub match {
     # first try wildcards
     my $wildstr = $str;
 
-    if ($wildstr =~ s/\*/\%/g) { # don't do wildcards if no '*' in the string
+    # Do not do wildcards if there is no '*' in the string.
+    if ($wildstr =~ s/\*/\%/g && $user->id) {
         # Build the query.
         trick_taint($wildstr);
         my $query  = "SELECT DISTINCT userid FROM profiles ";
@@ -1101,7 +1102,7 @@ sub match {
     }
 
     # then try substring search
-    if (!scalar(@users) && length($str) >= 3) {
+    if (!scalar(@users) && length($str) >= 3 && $user->id) {
         trick_taint($str);
 
         my $query   = "SELECT DISTINCT userid FROM profiles ";
-- 
cgit v1.2.3-24-g4f1b