Bommels05/Mozilla
Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 913904: (CVE-2013-1734) [SECURITY] CSRF when updating attachments

Browse Source 
r=dkl a=sgreen


git-svn-id: svn://10.0.0.236/trunk@265060 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
bzrmirror%bugzilla.org 2013-10-16 17:29:09 +00:00
parent 9a16a1609d
commit 7e6c565c4c
2 changed files with 11 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
mozilla/webtools/bugzilla/.bzrrev
View File

@ -1 +1 @@
8777
8778

17
mozilla/webtools/bugzilla/attachment.cgi
View File

@ -637,19 +637,22 @@ sub update {
$attachment->set_filename(scalar $cgi->param('filename'));
# Now make sure the attachment has not been edited since we loaded the page.
if (defined $cgi->param('delta_ts')
&& $cgi->param('delta_ts') ne $attachment->modification_time)
{
($vars->{'operations'}) = $bug->get_activity($attachment->id, $cgi->param('delta_ts'));
my $delta_ts = $cgi->param('delta_ts');
my $modification_time = $attachment->modification_time;
# The token contains the old modification_time. We need a new one.
$cgi->param('token', issue_hash_token([$attachment->id, $attachment->modification_time]));
if ($delta_ts && $delta_ts ne $modification_time) {
datetime_from($delta_ts)
or ThrowCodeError('invalid_timestamp', { timestamp => $delta_ts });
($vars->{'operations'}) = $bug->get_activity($attachment->id, $delta_ts);
# If the modification date changed but there is no entry in
# the activity table, this means someone commented only.
# In this case, there is no reason to midair.
if (scalar(@{$vars->{'operations'}})) {
$cgi->param('delta_ts', $attachment->modification_time);
$cgi->param('delta_ts', $modification_time);
# The token contains the old modification_time. We need a new one.
$cgi->param('token', issue_hash_token([$attachment->id, $modification_time]));
$vars->{'attachment'} = $attachment;
print $cgi->header();