Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 529416: (CVE-2009-3386) [SECURITY] Dependency lists display bug aliases even for bugs the user cannot access

Browse Source 
Patch by Dave Miller <justdave@bugzilla.org> r=LpSolit, r=mkanat, a=mkanat


git-svn-id: svn://10.0.0.236/trunk@259032 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
mkanat%bugzilla.org
2009-11-19 02:09:45 +00:00
parent 1ce756b744
commit 1ae47c24bd
1 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
mozilla/webtools/bugzilla/Bugzilla/Template.pm
View File

@@ -348,10 +348,6 @@ sub get_bug_link {
$bug = blessed($bug) ? $bug : new Bugzilla::Bug($bug);
return $link_text if $bug->{error};
if ($options->{use_alias} && $link_text =~ /^\d+$/ && $bug->alias) {
$link_text = $bug->alias;
}
# Initialize these variables to be "" so that we don't get warnings
# if we don't change them below (which is highly likely).
my ($pre, $title, $post) = ("", "", "");
@@ -369,6 +365,9 @@ sub get_bug_link {
}
if (Bugzilla->user->can_see_bug($bug)) {
$title .= " - " . $bug->short_desc;
if ($options->{use_alias} && $link_text =~ /^\d+$/ && $bug->alias) {
$link_text = $bug->alias;
}
}
# Prevent code injection in the title.
$title = html_quote(clean_text($title));