From f9214d522c9dabc0096573e553b946c492a65230 Mon Sep 17 00:00:00 2001
From: "gerv%gerv.net" <>
Date: Mon, 30 Aug 2004 04:29:34 +0000
Subject: Bug 225687 - add group controls to charts, along with various other
 cleanups. Patch by gerv; r=joel, a=justdave.

---
 editcomponents.cgi | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

(limited to 'editcomponents.cgi')

diff --git a/editcomponents.cgi b/editcomponents.cgi
index 28f5b9daf..e2e471f34 100755
--- a/editcomponents.cgi
+++ b/editcomponents.cgi
@@ -34,6 +34,7 @@ require "globals.pl";
 use Bugzilla::Constants;
 use Bugzilla::Config qw(:DEFAULT $datadir);
 use Bugzilla::Series;
+use Bugzilla::Util;
 
 use vars qw($template $vars);
 
@@ -328,15 +329,19 @@ if ($action eq 'new') {
 
     my @series;
 
-    my $prodcomp = "&product=$product&component=$component";
+    my $prodcomp = "&product=" . url_quote($product) . 
+                   "&component=" . url_quote($component);
 
     # For localisation reasons, we get the title of the queries from the
     # submitted form.
     my $open_name = $cgi->param('open_name');
     my $closed_name = $cgi->param('closed_name');
     my @openedstatuses = OpenStates();
-    my $statuses = join("&", map { "bug_status=$_" } @openedstatuses) . $prodcomp;
-    my $resolved = "field0-0-0=resolution&type0-0-0=notequals&value0-0-0=---" . $prodcomp;
+    my $statuses = 
+                  join("&", map { "bug_status=" . url_quote($_) } @openedstatuses) . 
+                  $prodcomp;
+    my $resolved = "field0-0-0=resolution&type0-0-0=notequals&value0-0-0=---" . 
+                   $prodcomp;
 
     # trick_taint is ok here, as these variables aren't used as a command
     # or in SQL unquoted
-- 
cgit v1.2.3-24-g4f1b