Closed
Bug 38854
Opened 25 years ago
Closed 24 years ago
reports.cgi needs to escape (untrusted) url params
Categories
(Bugzilla :: Bugzilla-General, defect, P3)
Tracking
()
RESOLVED
FIXED
Bugzilla 2.14
People
(Reporter: jruderman, Assigned: myk)
References
()
Details
(Whiteboard: security)
Attachments
(3 files)
(deleted),
patch
|
Details | Diff | Splinter Review | |
(deleted),
patch
|
Details | Diff | Splinter Review | |
(deleted),
patch
|
Details | Diff | Splinter Review |
note that reports.cgi has several output modes, so this needs to be fixed for
all modes.
Updated•24 years ago
|
Whiteboard: 2.14
Comment 1•24 years ago
|
||
moving to real milestones...
Whiteboard: 2.14
Target Milestone: --- → Bugzilla 2.14
Assignee | ||
Updated•24 years ago
|
Status: NEW → ASSIGNED
Assignee | ||
Comment 3•24 years ago
|
||
Comment 4•24 years ago
|
||
My biggest problem w/this patch is that if the product is defined, you don't get
the header (because of line 80). Also, the footers are suppressed. I realize
that this is mostly by design (the $FORM{'banner'} variable), but I think that
error messages could ignore that flag.
Of course, in theory, these messages should never be seen ;)
Assignee | ||
Comment 5•24 years ago
|
||
Assignee | ||
Comment 6•24 years ago
|
||
Assignee | ||
Comment 7•24 years ago
|
||
The patch I just attached reorganizes the code in reports.cgi so headers and
footers display correctly on errors and removes some crufty error checking code
that is no longer necessary.
I added a function to CGI.pl called "DisplayError" that uses the "errorhtml"
parameter to display validation errors. It works a lot like PuntTryAgain but it
prints HTTP response and HTML headers, and it doesn't stop execution after it
prints the message in order to make the calling code easier to understand, since:
DisplayError("blah") && exit;
is a lot more descriptive than:
DisplayError("blah");
Comment 8•24 years ago
|
||
Code looks good... I ran a few simple reports (on my 7 bugs ;) and everything
worked. Tested passing the param mentioned in the URL and got the error...
r=jake
Comment 9•24 years ago
|
||
Checked in.
Status: ASSIGNED → RESOLVED
Closed: 24 years ago
Resolution: --- → FIXED
Comment 10•23 years ago
|
||
Moving to Bugzilla product
Component: Bugzilla → Bugzilla-General
Product: Webtools → Bugzilla
Version: other → unspecified
Reporter | ||
Updated•21 years ago
|
Whiteboard: security
Updated•12 years ago
|
QA Contact: matty_is_a_geek → default-qa
You need to log in
before you can comment on or make changes to this bug.
Description
•