340253 - .cgi scripts should call Throw*Error() instead of die()

Status: RESOLVED FIXED

(Bugzilla :: Bugzilla-General, defect)

Description

[Frédéric Buclin]

die(), among others, displays the real path to your installation, which is reported by some people as a security risk. We should call Throw*Error() as it will also unlock tables if needed.

Only two .cgi scripts still use die():

process_bug.cgi:1894:   die "Error in list comparing code";
reports.cgi:235:        die "Invalid datasets $datasets";

Comment 1

[Frédéric Buclin]

Attachment: patch, v1

This patch fixes the first issue reported in bug 319087 (the easy one).

Comment 2

[Vlad Dascalu]

Comment on attachment 224318 [details] [diff] [review]
patch, v1

+    Invalid datasets <em>[% datasets FILTER html %]</em>. Only numbers,
+    letters and colons are allowed.

Numbers are to words like digits are to letters. We should stick with 'digits', otherwise people will start to believe that "1234", "a", ":" or "b" are ok but "abc" or "1a" aren't.

r=vladd if you fix that upon checkin (or you can carry the r+ on a new attachment)

Comment 3

[Frédéric Buclin]

tip:

Checking in process_bug.cgi;
/cvsroot/mozilla/webtools/bugzilla/process_bug.cgi,v  <--  process_bug.cgi
new revision: 1.321; previous revision: 1.320
done
Checking in reports.cgi;
/cvsroot/mozilla/webtools/bugzilla/reports.cgi,v  <--  reports.cgi
new revision: 1.82; previous revision: 1.81
done
Checking in template/en/default/global/code-error.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/global/code-error.html.tmpl,v  <--  code-error.html.tmpl
new revision: 1.69; previous revision: 1.68
done
Checking in template/en/default/global/user-error.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/global/user-error.html.tmpl,v  <--  user-error.html.tmpl
new revision: 1.170; previous revision: 1.169
done


2.22:

Checking in process_bug.cgi;
/cvsroot/mozilla/webtools/bugzilla/process_bug.cgi,v  <--  process_bug.cgi
new revision: 1.302.2.1; previous revision: 1.302
done
Checking in reports.cgi;
/cvsroot/mozilla/webtools/bugzilla/reports.cgi,v  <--  reports.cgi
new revision: 1.80.2.1; previous revision: 1.80
done
Checking in template/en/default/global/code-error.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/global/code-error.html.tmpl,v  <--  code-error.html.tmpl
new revision: 1.62.2.1; previous revision: 1.62
done
Checking in template/en/default/global/user-error.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/global/user-error.html.tmpl,v  <--  user-error.html.tmpl
new revision: 1.145.2.12; previous revision: 1.145.2.11
done