From 57dedfe96cc61022c737b604266de72b0bb7c612 Mon Sep 17 00:00:00 2001
From: "justdave%syndicomm.com"
 <justdave%syndicomm.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Mon, 3 Nov 2003 03:46:55 +0000
Subject: [PATCH] [SECURITY] Bug 219044: A user with 'editkeywords' privileges
 (i.e. usually an administrator) can inject arbitrary SQL via the URL used to
 edit an existing keyword. Patch by Joel Peshkin <bugreport@peshkin.net> r=
 justdave, zach   a= justdave

git-svn-id: svn://10.0.0.236/branches/BUGZILLA-2_16-BRANCH@148743 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/webtools/bugzilla/editkeywords.cgi | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mozilla/webtools/bugzilla/editkeywords.cgi b/mozilla/webtools/bugzilla/editkeywords.cgi
index 51294206dcb..2dbbeb6f3c1 100755
--- a/mozilla/webtools/bugzilla/editkeywords.cgi
+++ b/mozilla/webtools/bugzilla/editkeywords.cgi
@@ -123,6 +123,7 @@ unless (UserInGroup("editkeywords")) {
 
 
 my $action  = trim($::FORM{action}  || '');
+detaint_natural($::FORM{id});
 
 
 if ($action eq "") {