927900 - Kill longdesclength

Status: RESOLVED FIXED

(Bugzilla :: Creating/Changing Bugs, enhancement)

Description

[Frédéric Buclin]

The longdesclength parameter is used for midair collisions only, to know how many comments to display in the midair collision page, and to decide if this page should be displayed or not. One way to abuse the validator is to pass a large enough number so that

  my $do_midair = scalar @$comments > $start_at ? 1 : 0;

always returns 0. As we know delta_ts, we should use it instead to determine if there are new comments. If the attacker also tries to hack delta_ts (if set to a date in the future, the midair collision check will be happy and let it go through), then the token check will catch the timestamp mismatch and so there is no way for the attacker to go past this step.

Comment 1

[Frédéric Buclin]

Attachment: patch, v1

Comment 2

[Frédéric Buclin]

FYI, sort_order in bug/comments.html.tmpl is no longer used since Bugzilla 4.2, see bug 827983.

Comment 3

[David Lawrence [:dkl]]

Comment on attachment 829773 [details] [diff] [review]
patch, v1

Review of attachment 829773 [details] [diff] [review]:
-----------------------------------------------------------------

r=dkl

Comment 4

[Frédéric Buclin]

Committing to: bzr+ssh://[e-mail]/bugzilla/trunk/
modified email_in.pl
modified process_bug.cgi
modified template/en/default/bug/comments.html.tmpl
modified template/en/default/bug/edit.html.tmpl
modified template/en/default/bug/process/midair.html.tmpl
Committed revision 8812.