Bommels05/Mozilla
Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 621108: [SECURITY] Creating/editing charts lacks CSRF protection

Browse Source 
r=dkl a=LpSolit


git-svn-id: svn://10.0.0.236/trunk@261805 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
mkanat%bugzilla.org 2011-01-24 17:27:06 +00:00
parent ad969a4c73
commit 5591cfca76
4 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
mozilla/webtools/bugzilla/.bzrrev
View File

@ -1 +1 @@
7668
7669

8
mozilla/webtools/bugzilla/chart.cgi
View File

@ -146,6 +146,8 @@ elsif ($action eq "wrap") {
}
elsif ($action eq "create") {
assertCanCreate($cgi);
my $token = $cgi->param('token');
check_hash_token($token, ['create-series']);
my $series = new Bugzilla::Series($cgi);
@ -164,9 +166,11 @@ elsif ($action eq "edit") {
edit($series);
}
elsif ($action eq "alter") {
assertCanEdit($series_id);
my $series = assertCanEdit($series_id);
my $token = $cgi->param('token');
check_hash_token($token, [$series->id, $series->name]);
# XXX - This should be replaced by $series->set_foo() methods.
my $series = new Bugzilla::Series($cgi);
$series = new Bugzilla::Series($cgi);
# We need to check if there is _another_ series in the database with
# our (potentially new) name. So we call existsInDatabase() to see if

2
mozilla/webtools/bugzilla/template/en/default/reports/edit-series.html.tmpl
View File

@ -40,6 +40,8 @@
[% PROCESS reports/series.html.tmpl
button_name = "Change Data Set" %]
<input type="hidden" name="action" value="alter">
<input type="hidden" name="token"
value="[% issue_hash_token([default.id, default.name]) FILTER html %]">
[% IF default.series_id %]
<input type="hidden" name="series_id" value="[% default.series_id %]">

1
mozilla/webtools/bugzilla/template/en/default/search/search-create-series.html.tmpl
View File

@ -54,6 +54,7 @@
[% PROCESS reports/series.html.tmpl
button_name = "Create Data Set" %]
<input type="hidden" name="action" value="create">
<input type="hidden" name="token" value="[% issue_hash_token(['create-series']) FILTER html %]">
<script type="text/javascript">
document.chartform.category[0].selected = true;