Bug 283562: Insecure dependency in parameter 3 of DBI::db (login_to_id forgets a trick_taint)

Patch By Max Kanat-Alexander <mkanat@kerio.com> r=wurblzap, r=joel, a=justdave


git-svn-id: svn://10.0.0.236/trunk@169915 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/webtools/bugzilla/Bugzilla/User.pm

@@ -1013,10 +1013,11 @@ sub is_available_username ($;$) {
 sub login_to_id ($) {
     my ($login) = (@_);
     my $dbh = Bugzilla->dbh;
+    # $login will only be used by the following SELECT statement, so it's safe.
+    trick_taint($login);
     my $user_id = $dbh->selectrow_array(
         "SELECT userid FROM profiles WHERE login_name = ?", undef, $login);
-    # $user_id should be a positive integer, this makes Taint mode happy
-    if (defined $user_id && detaint_natural($user_id)) {
+    if ($user_id) {
         return $user_id;
     } else {
         return 0;