Bommels05/Mozilla
Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Undef to trick taint issues

Browse Source 
git-svn-id: svn://10.0.0.236/trunk@227346 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
ghendricks%novell.com 2007-05-31 19:47:39 +00:00
parent 475117ae35
commit b6b3fe39e4
2 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
mozilla/webtools/testopia/Bugzilla/Testopia/TestCase.pm
View File

@ -803,7 +803,6 @@ sub update {
'test_fielddefs READ');
foreach my $field (keys %{$newvalues}){
if ($self->{$field} ne $newvalues->{$field}){
trick_taint($newvalues->{$field});
$dbh->do("UPDATE test_cases
SET $field = ? WHERE case_id = ?",
undef, $newvalues->{$field}, $self->{'case_id'});

15
mozilla/webtools/testopia/tr_list_caseruns.cgi
View File

@ -122,13 +122,18 @@ if ($action eq 'Commit'){
$caserun = $caserun->switch($build,$env);
my $status = $cgi->param('status') == -1 ? $caserun->status_id : $cgi->param('status');
my $assignee = $cgi->param('assignee') eq '' ? $caserun->assignee->id : login_to_id(trim($cgi->param('assignee')));
unless ($assignee){
print $cgi->multipart_end if $serverpush;
ThrowUserError("invalid_username", { name => $cgi->param('assignee') });
my $assignee;
if ($cgi->param('assignee') eq ''){
$assignee = $caserun->assignee->id if $caserun->assignee;
}
else {
$assignee = login_to_id(trim($cgi->param('assignee')));
unless ($assignee){
print $cgi->multipart_end if $serverpush;
ThrowUserError("invalid_username", { name => $cgi->param('assignee') });
}
}
detaint_natural($status);
trick_taint($assignee);
$caserun->set_status($status) if ($caserun->status_id != $status);
$caserun->set_assignee($assignee) if ($caserun->assignee->id != $assignee);