Closed Bug 38855 Opened 24 years ago Closed 23 years ago

showvotes.cgi needs to escape (untrusted) url params

Categories

(Bugzilla :: Bugzilla-General, defect, P3)

Other
Other
defect

Tracking

()

RESOLVED FIXED
Bugzilla 2.14

People

(Reporter: jruderman, Assigned: myk)

References

()

Details

(Whiteboard: security)

Attachments

(2 files)

      No description provided.
Blocks: 38852
Whiteboard: 2.14
moving to real milestones...
Whiteboard: 2.14
Target Milestone: --- → Bugzilla 2.14
-> myself & I have a patch
Assignee: tara → myk
Keywords: patch
Status: NEW → ASSIGNED
What about a subroutine ErrorExit(Title, ErrMsg) for these lines:
+    print "Content-type: text/html\n\n";
+    PutHeader($Title);
+    print "<p>$ErrMsg<p>\n";
+    PutFooter();
+    exit;

This could be useful elsewhere, too...
I'm not sure that it needs to validate the bug number/UID against the
database... I think it'd probably be enough that it made sure it was a number.
But I suppose taking the validation the next step does allow for better error
messages, and it does only validate the one that "matters".

So, all in all, I'd say r=jake
*** Bug 39537 has been marked as a duplicate of this bug. ***
Jake, could you re-review my new patch?
Using the Param("errorhtml")... nice touch :)

r=jake
Checked in.
Status: ASSIGNED → RESOLVED
Closed: 23 years ago
Resolution: --- → FIXED
Moving to Bugzilla product
Component: Bugzilla → Bugzilla-General
Product: Webtools → Bugzilla
Version: other → unspecified
Whiteboard: security
QA Contact: matty_is_a_geek → default-qa
You need to log in before you can comment on or make changes to this bug.