537030 - src param not trickling down EULA

Status: VERIFIED FIXED

(addons.mozilla.org Graveyard :: Public Pages, defect, P2)

Description

[Justin Scott [:fligtar]]

The src param should trickle to the install button on the EULA page.

https://addons.mozilla.org/en-US/firefox/addons/policy/0/52659/71526?src=recommended

Comment 1

[Justin Scott [:fligtar]]

Can we please fix this for 5.5?

Comment 2

[Ryan Doherty (:rdoherty)]

Attachment: v1

Comment 3

[Wil Clouser [:clouserw]]

Comment on attachment 419976 [details] [diff] [review]
v1

>-      if (array_key_exists('src', $_GET) && in_array($_GET['src'], array('addondetail'))) {
>+      if (array_key_exists('src', $_GET)) {

The in_array() keeps it from becoming an injection hole.  However, I think you've found the easy 1-line fix spot.  We just need to expand what in_array() is checking.

Comment 4

[Ryan Doherty (:rdoherty)]

Attachment: v2

Comment 5

[Ryan Doherty (:rdoherty)]

(In reply to comment #4)
> Created an attachment (id=419989) [details]
> v2

Added urlencode to appendParametersToUrl(). I don't think a whitelist will work for us b/c people can always add a src that will start with 'external-'.

Comment 6

[Wil Clouser [:clouserw]]

Comment on attachment 419989 [details] [diff] [review]
v2

I think that'll work, thanks

Comment 7

[Ryan Doherty (:rdoherty)]

r58928

Comment 8

[Stephen Donner [:stephend] Not actively reading bugmail]

Is testing on https://preview.addons.mozilla.org/en-US/firefox/addons/policy/0/11730/53612?src=developers enough, or should I test all the various src=parameters?

Comment 9

[Ryan Doherty (:rdoherty)]

(In reply to comment #8)
> Is testing on
> https://preview.addons.mozilla.org/en-US/firefox/addons/policy/0/11730/53612?src=developers
> enough, or should I test all the various src=parameters?

Any src should work, there's no validation, just escaping of the entered src.

Comment 10

[Stephen Donner [:stephend] Not actively reading bugmail]

Thx, Ryan: verified on a couple, at least:

* https://preview.addons.mozilla.org/en-US/firefox/addons/policy/0/43603/66437?src=homepagebrowse
* https://preview.addons.mozilla.org/en-US/firefox/addons/policy/0/11730/53612?src=developers