768870 - No token assigned to "Un-forget the search"

Status: RESOLVED FIXED

(Bugzilla :: Query/Bug List, defect)

Description

[laurens.bal]

Step 1: Login with your account on bugzilla.mozilla.org
Step 2: Use query.cgi to perform a search
Step 3: Save your requested search  as "mysearch"
Step 4: Click on the link "Forget Search Mysearch"
Step 5: Click now on the link "Un-forget the search"

You will now be redirected to a page that asks for the token. 
Because there is no token added to this request.

Greets,

Laurens

Comment 1

[Frédéric Buclin]

Regression due to bug 621090. As we regressed this in 4.0, we should fix it there too, despite not being a security issue. Patch coming.

Comment 2

[Frédéric Buclin]

Attachment: patch, v1

Comment 3

[:glob ✱]

Comment on attachment 637112 [details] [diff] [review]
patch, v1

r=glob

Comment 4

[Frédéric Buclin]

Committing to: bzr+ssh://[e-mail]/bugzilla/trunk/
modified buglist.cgi
Committed revision 8278.

Committing to: bzr+ssh://[e-mail]/bugzilla/4.2/
modified buglist.cgi
Committed revision 8099.

Committing to: bzr+ssh://[e-mail]/bugzilla/4.0/
modified buglist.cgi
Committed revision 7711.

Comment 5

[Reed Loden [:reed]]

This has been deployed on bmo.

Comment 6

[Jeren]

Comment on attachment 637112 [details] [diff] [review]
patch, v1

>Index: buglist.cgi
>===================================================================
>RCS file: /cvsroot/mozilla/webtools/bugzilla/buglist.cgi,v
>retrieving revision 1.444
>diff -p -u -r1.444 buglist.cgi
>--- buglist.cgi	7 Jun 2012 21:45:44 -0000	1.444
>+++ buglist.cgi	27 Jun 2012 14:29:44 -0000
>@@ -422,7 +422,9 @@ if ($cmdtype eq "dorem") {  
>         # Generate and return the UI (HTML page) from the appropriate template.
>         $vars->{'message'} = "buglist_query_gone";
>         $vars->{'namedcmd'} = $qname;
>-        $vars->{'url'} = "buglist.cgi?newquery=" . url_quote($buffer) . "&cmdtype=doit&remtype=asnamed&newqueryname=" . url_quote($qname);
>+        $vars->{'url'} = "buglist.cgi?newquery=" . url_quote($buffer)
>+                         . "&cmdtype=doit&remtype=asnamed&newqueryname=" . url_quote($qname)
>+                         . "&token=" . url_quote(issue_hash_token(['savedsearch']));
>         $template->process("global/message.html.tmpl", $vars)
>           || ThrowTemplateError($template->error());
>         exit;