38855 - showvotes.cgi needs to escape (untrusted) url params

Status: RESOLVED FIXED

(Bugzilla :: Bugzilla-General, defect, P3)

Comment 1

[Dave Miller [:justdave]]

moving to real milestones...

Comment 2

[Myk Melez [:myk] [@mykmelez]]

-> myself & I have a patch

Comment 3

[Myk Melez [:myk] [@mykmelez]]

Attachment: validates user, bug_id, and voteon parameters

Comment 4

[Andreas Franke (gone)]

What about a subroutine ErrorExit(Title, ErrMsg) for these lines:
+    print "Content-type: text/html\n\n";
+    PutHeader($Title);
+    print "<p>$ErrMsg<p>\n";
+    PutFooter();
+    exit;

This could be useful elsewhere, too...

Comment 5

[Jacob Steenhagen]

I'm not sure that it needs to validate the bug number/UID against the
database... I think it'd probably be enough that it made sure it was a number.
But I suppose taking the validation the next step does allow for better error
messages, and it does only validate the one that "matters".

So, all in all, I'd say r=jake

Comment 6

[Jacob Steenhagen]

*** Bug 39537 has been marked as a duplicate of this bug. ***

Comment 7

[Myk Melez [:myk] [@mykmelez]]

Attachment: uses DisplayError function to simplify display of errors

Comment 8

[Myk Melez [:myk] [@mykmelez]]

Jake, could you re-review my new patch?

Comment 9

[Jacob Steenhagen]

Using the Param("errorhtml")... nice touch :)

r=jake

Comment 10

[Dave Miller [:justdave]]

Checked in.

Comment 11

[Dave Miller [:justdave]]

Moving to Bugzilla product