aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorjustdave%syndicomm.com <>2003-11-03 11:31:30 +0000
committerjustdave%syndicomm.com <>2003-11-03 11:31:30 +0000
commita4e75a434f1fbbae4b438927ae02958baad7f1b7 (patch)
tree74a5ab12bbf20c934af898475a3f6c7303b68013 /editkeywords.cgi
parent[SECURITY] Bug 209742: Under some circumstances, a user can obtain component ... (diff)
downloadbugzilla-a4e75a434f1fbbae4b438927ae02958baad7f1b7.tar.gz
bugzilla-a4e75a434f1fbbae4b438927ae02958baad7f1b7.tar.bz2
bugzilla-a4e75a434f1fbbae4b438927ae02958baad7f1b7.zip
[SECURITY] Bug 219044: A user with 'editkeywords' privileges (i.e. usually an administrator) can inject arbitrary SQL via the URL used to edit an existing keyword.
Patch by Joel Peshkin <bugreport@peshkin.net> r= justdave, zach a= justdave
Diffstat (limited to 'editkeywords.cgi')
-rwxr-xr-xeditkeywords.cgi1
1 files changed, 1 insertions, 0 deletions
diff --git a/editkeywords.cgi b/editkeywords.cgi
index 073dfbb9d..7af0c1a6c 100755
--- a/editkeywords.cgi
+++ b/editkeywords.cgi
@@ -126,6 +126,7 @@ unless (UserInGroup("editkeywords")) {
my $action = trim($::FORM{action} || '');
+detaint_natural($::FORM{id});
if ($action eq "") {