234879 - Remove %FORM from editkeywords.cgi

Status: RESOLVED FIXED

(Bugzilla :: Bugzilla-General, defect)

Description

[Vlad Dascalu]

Use $cgi->param in editkeywords.cgi.

Comment 1

[Vlad Dascalu]

Attachment: Version 1

Comment 2

[Christian Reis]

Comment on attachment 141739 [details] [diff] [review]
Version 1

>Index: >@@ -173,7 +173,10 @@
> #
> 
> if ($action eq 'edit') {
>-    my $id  = trim($::FORM{id} || 0);
>+    my $id = cgi->param('id');
>+    detaint_natural($id);
>+    $id  = trim($id || 0);

Make sure you still need the trim after detaint_natural; I'm not sure myself.
Is zero used for anything special here? If so, it would be nice to add a
comment...

Comment 3

[Dave Miller [:justdave]]

Comment on attachment 141739 [details] [diff] [review]
Version 1

>@@ -173,7 +173,10 @@
>-    my $id  = trim($::FORM{id} || 0);
>+    my $id = cgi->param('id');
>+    detaint_natural($id);
>+    $id  = trim($id || 0);

kiko's got a point... this won't work.	If the value had spaces around it and
thus needs to be trimmed, it's going to fail the detaint_natural.  Need to trim
it first before calling detaint_natural on it.

Comment 4

[Vlad Dascalu]

It used to get trimmed after detaining it in the old code. But good point, 
*nods*.

Comment 5

[Vlad Dascalu]

Attachment: Version 2

0 is not a special case, so I removed that as well.

Comment 6

[Vlad Dascalu]

Checking in editkeywords.cgi;
/cvsroot/mozilla/webtools/bugzilla/editkeywords.cgi,v  <--  editkeywords.cgi
new revision: 1.20; previous revision: 1.19
done