From 368fa4c0afeeb58d9ef67a255ae2e7c3a2defd3c Mon Sep 17 00:00:00 2001
From: Koosha Khajeh Moogahi <koosha.khajeh@gmail.com>
Date: Mon, 28 May 2012 01:36:39 +0200
Subject: Bug 754981: Add a link pointing to the bug itself in HTML bugmails
 when only a comment is added r/a=LpSolit

---
 template/en/default/email/bugmail.html.tmpl | 1 +
 1 file changed, 1 insertion(+)

(limited to 'template/en/default')

diff --git a/template/en/default/email/bugmail.html.tmpl b/template/en/default/email/bugmail.html.tmpl
index e42b5564d..f8f182548 100644
--- a/template/en/default/email/bugmail.html.tmpl
+++ b/template/en/default/email/bugmail.html.tmpl
@@ -33,6 +33,7 @@
           [% IF comment.count %]
             <b>[% "Comment # ${comment.count}" FILTER bug_link( bug, 
               {comment_num => comment.count, full_url => 1}) FILTER none %] 
+              on [% "$terms.bug $bug.id" FILTER bug_link( bug, { full_url => 1 }) FILTER none %]
               from [% INCLUDE global/user.html.tmpl who = comment.author %]</b>
           [% END %]
         <pre>[% comment.body_full({ wrap => 1 }) FILTER quoteUrls(bug, comment) %]</pre>
-- 
cgit v1.2.3-24-g4f1b


From 71be6327da8fbfd2207a9e5826da98f25caca403 Mon Sep 17 00:00:00 2001
From: Byron Jones <bjones@mozilla.com>
Date: Tue, 29 May 2012 00:58:23 +0800
Subject: Bug 756314: Fix dropping of unique matches when the "confirm page"
 page is display. r=LpSolit, a=LpSolit

---
 template/en/default/global/confirm-user-match.html.tmpl | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'template/en/default')

diff --git a/template/en/default/global/confirm-user-match.html.tmpl b/template/en/default/global/confirm-user-match.html.tmpl
index 5549b516d..cff20d237 100644
--- a/template/en/default/global/confirm-user-match.html.tmpl
+++ b/template/en/default/global/confirm-user-match.html.tmpl
@@ -150,8 +150,6 @@
                 [% ELSE %]
                   matched
                   <b>[% query.value.users.0.identity FILTER html %]</b>
-                  <input type="hidden" name="[% field.key FILTER html %]"
-                         value="[% query.value.users.0.login FILTER html %]">
                 [% END %]
             [% ELSE %]
                 [% IF (query.key.length < 3) && !Param('emailsuffix') %]
@@ -176,8 +174,10 @@
 
 [% IF matchsuccess == 1 %]
 
-  [% SET exclude_these = 
-           matches.keys.merge(['Bugzilla_login', 'Bugzilla_password']) %]
+  [% SET exclude_these = ['Bugzilla_login', 'Bugzilla_password'] %]
+  [% FOREACH key IN matches.keys %]
+    [% exclude_these.push(key) IF cgi.param(key) == '' %]
+  [% END %]
   [% SET exclude = '^' _ exclude_these.join('|') _ '$' %]
   [% PROCESS "global/hidden-fields.html.tmpl" exclude = exclude %]
 
-- 
cgit v1.2.3-24-g4f1b


From 3004a5e322c3a95c7e51978b917f1547c382bac9 Mon Sep 17 00:00:00 2001
From: Reed Loden <reed@reedloden.com>
Date: Tue, 29 May 2012 07:52:31 -0700
Subject: Bug 754673 - CSRF vulnerability in query.cgi allows possible
 unauthorized use of "Set my default search back to the system default"
 [r=LpSolit a=LpSolit]

---
 template/en/default/search/knob.html.tmpl | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'template/en/default')

diff --git a/template/en/default/search/knob.html.tmpl b/template/en/default/search/knob.html.tmpl
index 17ff63a10..a50f6bd32 100644
--- a/template/en/default/search/knob.html.tmpl
+++ b/template/en/default/search/knob.html.tmpl
@@ -79,7 +79,8 @@
         
 [% IF userdefaultquery %]
   <p>
-    <a href="query.cgi?nukedefaultquery=1">
+    <a href="query.cgi?nukedefaultquery=1&amp;token=
+       [%- issue_hash_token(['nukedefaultquery']) FILTER uri %]">
       Set my default search back to the system default</a>.
   </p>
 [% END %]
-- 
cgit v1.2.3-24-g4f1b


From 6b9b50db744c603dbfa0c7ae5aac8dca4e58b0cd Mon Sep 17 00:00:00 2001
From: Reed Loden <reed@reedloden.com>
Date: Tue, 29 May 2012 08:23:18 -0700
Subject: Bug 754672 - CSRF vulnerability in buglist.cgi allows possible
 unauthorized setting of default search options [r=LpSolit a=LpSolit]

---
 template/en/default/search/knob.html.tmpl | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

(limited to 'template/en/default')

diff --git a/template/en/default/search/knob.html.tmpl b/template/en/default/search/knob.html.tmpl
index a50f6bd32..e20822bf5 100644
--- a/template/en/default/search/knob.html.tmpl
+++ b/template/en/default/search/knob.html.tmpl
@@ -40,6 +40,9 @@
    "Last Changed" => "Last Changed" } %]
 
 <input type="hidden" name="cmdtype" value="doit">
+[% IF user.id %]
+  <input type="hidden" name="token" value="[% issue_hash_token(['searchknob']) FILTER html %]">
+[% END %]
 
 <p>
   <label for="order">Sort results by</label>:
@@ -56,7 +59,7 @@
   <input type="submit" id="[% button_name FILTER html %]"
          value="[% button_name FILTER html %]">
   [% IF known_name %]
-    [%# We store known_name in case the user add a boolean chart. %]
+    [%# We store known_name in case the user adds a boolean chart. %]
     <input type="hidden" name="known_name" value="[% known_name FILTER html %]">
 
     [%# The name of the existing query will be passed to buglist.cgi. %]
@@ -68,14 +71,16 @@
   [% END %]
 </p>
 
-<p>
-  &nbsp;&nbsp;&nbsp;
-  <input type="checkbox" id="remasdefault"
-         name="remtype" value="asdefault">
-  <label for="remasdefault">
-    and remember these as my default search options
-  </label>
-</p>
+[% IF user.id %]
+  <p>
+    &nbsp;&nbsp;&nbsp;
+    <input type="checkbox" id="remasdefault"
+           name="remtype" value="asdefault">
+    <label for="remasdefault">
+      and remember these as my default search options
+    </label>
+  </p>
+[% END %]
         
 [% IF userdefaultquery %]
   <p>
-- 
cgit v1.2.3-24-g4f1b