From 3194b05f37556affc001bcc2d4a68aa4d4a9bda8 Mon Sep 17 00:00:00 2001
From: "bzrmirror%bugzilla.org"
 <bzrmirror%bugzilla.org@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Wed, 16 Oct 2013 17:33:13 +0000
Subject: [PATCH] Bug 924802: (CVE-2013-1742) [SECURITY] (XSS) "id" and
 "sortkey" are not sanitized when editing flag types if categoryAction-foo is
 set r=dkl a=glob

git-svn-id: svn://10.0.0.236/trunk@265061 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/webtools/bugzilla/.bzrrev                           | 2 +-
 .../template/en/default/admin/flag-type/edit.html.tmpl      | 6 +++---
 .../bugzilla/template/en/default/filterexceptions.pl        | 2 --
 3 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/mozilla/webtools/bugzilla/.bzrrev b/mozilla/webtools/bugzilla/.bzrrev
index 9eef83b4e66..c66715c8a37 100644
--- a/mozilla/webtools/bugzilla/.bzrrev
+++ b/mozilla/webtools/bugzilla/.bzrrev
@@ -1 +1 @@
-8778
\ No newline at end of file
+8779
\ No newline at end of file
diff --git a/mozilla/webtools/bugzilla/template/en/default/admin/flag-type/edit.html.tmpl b/mozilla/webtools/bugzilla/template/en/default/admin/flag-type/edit.html.tmpl
index b9ad2a5355f..2e9771384d7 100644
--- a/mozilla/webtools/bugzilla/template/en/default/admin/flag-type/edit.html.tmpl
+++ b/mozilla/webtools/bugzilla/template/en/default/admin/flag-type/edit.html.tmpl
@@ -36,7 +36,7 @@
 <form id="flagtype_properties" method="post" action="editflagtypes.cgi">
   <input type="hidden" name="action" value="[% action FILTER html %]">
   <input type="hidden" name="can_fully_edit" value="[% can_fully_edit FILTER html %]">
-  <input type="hidden" name="id" value="[% type.id %]">
+  <input type="hidden" name="id" value="[% type.id FILTER html %]">
   <input type="hidden" name="token" value="[% token FILTER html %]">
   <input type="hidden" name="target_type" value="[% type.target_type FILTER html %]">
   <input type="hidden" name="check_clusions" value="[% check_clusions FILTER none %]">
@@ -133,8 +133,8 @@
         this type will be sorted when displayed to users in a list; ignore if you
         don't care what order the types appear in or if you want them to appear
         in alphabetical order.<br>
-        <input type="text" name="sortkey" value="[% type.sortkey || 0 %]" size="5" maxlength="5"
-               [%- ' disabled="disabled"' UNLESS can_fully_edit %]>
+        <input type="text" name="sortkey" value="[% type.sortkey || 0 FILTER html %]" size="5"
+               maxlength="5" [% ' disabled="disabled"' UNLESS can_fully_edit %]>
       </td>
     </tr>
 
diff --git a/mozilla/webtools/bugzilla/template/en/default/filterexceptions.pl b/mozilla/webtools/bugzilla/template/en/default/filterexceptions.pl
index 36b9032ddae..239b6828cdf 100644
--- a/mozilla/webtools/bugzilla/template/en/default/filterexceptions.pl
+++ b/mozilla/webtools/bugzilla/template/en/default/filterexceptions.pl
@@ -386,8 +386,6 @@
 ],
 
 'admin/flag-type/edit.html.tmpl' => [
-  'type.id', 
-  'type.sortkey || 0',
   'selname',
 ],