Bommels05/Mozilla
Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 824399: (CVE-2013-0786) [SECURITY] build_subselect() leaks the existence of products and components you cannot access

Browse Source 
r/a=LpSolit


git-svn-id: svn://10.0.0.236/trunk@264768 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
mkanat%bugzilla.org 2013-02-19 17:15:41 +00:00
parent f7f5728a6a
commit 0a81634be5
5 changed files with 23 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
mozilla/webtools/bugzilla/.bzrrev
View File

@ -1 +1 @@
8585
8586

8
mozilla/webtools/bugzilla/Bugzilla/Config/GroupSecurity.pm
View File

@ -57,6 +57,14 @@ sub get_param_list {
checker => \&check_group
},
{
name => 'debug_group',
type => 's',
choices => \&_get_all_group_names,
default => 'admin',
checker => \&check_group
},
{
name => 'usevisibilitygroups',
type => 'b',

5
mozilla/webtools/bugzilla/buglist.cgi
View File

@ -721,7 +721,10 @@ $::SIG{PIPE} = 'DEFAULT';
my ($data, $extra_data) = $search->data;
$vars->{'search_description'} = $search->search_description;
if ($cgi->param('debug')) {
if ($cgi->param('debug')
&& Bugzilla->params->{debug_group}
&& $user->in_group(Bugzilla->params->{debug_group})
) {
$vars->{'debug'} = 1;
$vars->{'queries'} = $extra_data;
my $query_time = 0;

8
mozilla/webtools/bugzilla/report.cgi
View File

@ -258,7 +258,13 @@ $vars->{'width'} = $width;
$vars->{'height'} = $height;
$vars->{'queries'} = $extra_data;
$vars->{'saved_report_id'} = $cgi->param('saved_report_id');
$vars->{'debug'} = $cgi->param('debug');
if ($cgi->param('debug')
&& Bugzilla->params->{debug_group}
&& Bugzilla->user->in_group(Bugzilla->params->{debug_group})
) {
$vars->{'debug'} = 1;
}
if ($action eq "wrap") {
# So which template are we using? If action is "wrap", we will be using

3
mozilla/webtools/bugzilla/template/en/default/admin/params/groupsecurity.html.tmpl
View File

@ -29,6 +29,9 @@
querysharegroup => "The name of the group of users who can share their " _
"saved searches with others.",
debug_group => "The name of the group of users who can view the actual " _
"SQL query generated when viewing $terms.bug lists and reports.",
usevisibilitygroups => "Do you wish to restrict visibility of users to members of " _
"specific groups?",