From ab0b6b7d14b42b05ae2598c908b6dbfd35207048 Mon Sep 17 00:00:00 2001
From: "mkanat%kerio.com"
 <mkanat%kerio.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Sun, 27 Feb 2005 01:08:12 +0000
Subject: [PATCH] Bug 283562: Insecure dependency in parameter 3 of DBI::db
 (login_to_id forgets a trick_taint) Patch By Max Kanat-Alexander
 <mkanat@kerio.com> r=wurblzap, r=joel, a=justdave

git-svn-id: svn://10.0.0.236/trunk@169915 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/webtools/bugzilla/Bugzilla/User.pm | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/mozilla/webtools/bugzilla/Bugzilla/User.pm b/mozilla/webtools/bugzilla/Bugzilla/User.pm
index 4d4787525da..f87f021b900 100644
--- a/mozilla/webtools/bugzilla/Bugzilla/User.pm
+++ b/mozilla/webtools/bugzilla/Bugzilla/User.pm
@@ -1013,10 +1013,11 @@ sub is_available_username ($;$) {
 sub login_to_id ($) {
     my ($login) = (@_);
     my $dbh = Bugzilla->dbh;
+    # $login will only be used by the following SELECT statement, so it's safe.
+    trick_taint($login);
     my $user_id = $dbh->selectrow_array(
         "SELECT userid FROM profiles WHERE login_name = ?", undef, $login);
-    # $user_id should be a positive integer, this makes Taint mode happy
-    if (defined $user_id && detaint_natural($user_id)) {
+    if ($user_id) {
         return $user_id;
     } else {
         return 0;