666279 - it's possible to get a list of all bugs with buglist.cgi

Status: RESOLVED DUPLICATE of bug 255606

(Bugzilla :: Query/Bug List, defect)

Description

[:glob ✱]

if you hit buglist.cgi with a querystring beginning with = bugzilla will perform a search which results all bugs.

this should be caught and throw a buglist_parameters_required error.

Comment 1

[David Lawrence [:dkl]]

Attachment: Patch that removes empty cgi params with blank param names (v1)

Patch that adds code to Bugzilla::CGI::clean_search_url that removes any params with empty names. Previously they were not removed and using an improperly formed search url, the user could pull in every bug in the database.

dkl

Comment 2

[Max Kanat-Alexander]

No, there are a zillion ways to grab every bug in the database, fixing every single one of them on the frontend side is definitely the wrong solution. The right answer is to have Search.pm understand when it has received no criteria and have it throw an error. This is not very hard at all, with the new architecture, so should be quite doable for 4.2 if you would like to implement it there.

There's already a bug filed for this (I believe) but I can't find it at the moment. In any case, you should know in advance that I won't approve a patch that modifies clean_search_url to remove things that Bugzilla doesn't generate itself--I think fixing up Search.pm is a much more reliable and simple solution.

Comment 3

[Max Kanat-Alexander]

I'd say that this is generally a duplicate of bug 255606.