283562 - Insecure dependency in parameter 3 of DBI::db (login_to_id forgets a trick_taint)

Status: RESOLVED FIXED

(Bugzilla :: User Accounts, defect, P1)

Description

[Dev Anand]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

Software error:

Insecure dependency in parameter 3 of DBI::db=HASH(0x8f3c9f8)->selectrow_array
method call while running with -T switch at Bugzilla/User.pm line 1016.

in 2.19.2 development release

Reproducible: Always

Steps to Reproduce:
1.Home Page
2.New Account
3. Fill email and name and create account

Actual Results:  
Software error:

Insecure dependency in parameter 3 of DBI::db=HASH(0x8f3c9f8)->selectrow_array
method call while running with -T switch at Bugzilla/User.pm line 1016.

Expected Results:  
Should have created the user and sent email with password

Comment 1

[Max Kanat-Alexander]

Is this in the actually released 2.19.2, or in the cvs tip? I'm assuming it's in
2.19.2. I'll investigate.

Comment 2

[Dev Anand]

I am using the CVS tip

Comment 3

[Max Kanat-Alexander]

  Ahh, looks like I just introduced that today. :-)

    my $user_id = $dbh->selectrow_array(
        "SELECT userid FROM profiles WHERE login_name = ?", undef, $login);

Comment 4

[Max Kanat-Alexander]

Attachment: Add a trick_taint and remove the silly detaint_natural

This also includes a fix for bug 283334, because it was easy to do while I was
doing this.

Comment 5

[Marc Schumann [:Wurblzap]]

Comment on attachment 175528 [details] [diff] [review]
Add a trick_taint and remove the silly detaint_natural

r=wurblzap by inspection.

Nit: could've made that return selectrow_array || 0, enhancing readability
imho.

Comment 6

[Teemu Mannermaa (:wicked)]

*** Bug 283781 has been marked as a duplicate of this bug. ***

Comment 7

[Joel Peshkin]

Also kills "My Bugs"

Comment 8

[Joel Peshkin]

Comment on attachment 175528 [details] [diff] [review]
Add a trick_taint and remove the silly detaint_natural

2xr=joel
This needs to go in right away

Comment 9

[Max Kanat-Alexander]

Checking in Bugzilla/User.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/User.pm,v  <--  User.pm
new revision: 1.40; previous revision: 1.39
done