283085 - post_bug.cgi can be used to know which products do not exist and which ones are not accessible

Status: RESOLVED FIXED

(Bugzilla :: Creating/Changing Bugs, defect)

Description

[Frédéric Buclin]

In post_bug.cgi, we have the following sequence:

my $product = $::FORM{'product'};
my $product_id = get_product_id($product);
if (!$product_id) {
    ThrowUserError("invalid_product_name",
                   { product => $product });
}

and later:

if (!CanEnterProduct($product)) {
    ThrowUserError("entry_access_denied", {product => $product});
}

This can be used by a user to know which products exist and which ones are not
accessible. As per bug 153461 comment 18 about describecomponents.cgi, this
information should not be given.

Then the correct fix is the same as the one applied in enter_bug.cgi:

my $product = $::FORM{'product'};
if (!CanEnterProduct($product)) {
    ThrowUserError("entry_access_denied", {product => $product});
}
my $product_id = get_product_id($product);

Comment 1

[Frédéric Buclin]

Attachment: patch, v1

Comment 2

[Myk Melez [:myk] [@mykmelez]]

Comment on attachment 175079 [details] [diff] [review]
patch, v1

r=myk

Comment 3

[Myk Melez [:myk] [@mykmelez]]

This is a minor security issue and should go into 2.18.

Comment 4

[Shane H. W. Travis]

2.18:
Checking in post_bug.cgi;
/cvsroot/mozilla/webtools/bugzilla/post_bug.cgi,v  <--  post_bug.cgi
new revision: 1.88.2.4; previous revision: 1.88.2.3
done

Tip:
Checking in post_bug.cgi;
/cvsroot/mozilla/webtools/bugzilla/post_bug.cgi,v  <--  post_bug.cgi
new revision: 1.102; previous revision: 1.101
done