Bug 515191: [SECURITY] SQL Injection via Bug.search (CVE-2009-3125) and Bug.create (CVE-2009-3165)

Patch by Max Kanat-Alexander <mkanat@bugzilla.org> r=LpSolit, a=mkanat git-svn-id: svn://10.0.0.236/trunk@258359 18797224-902f-48f8-a5cc-f745e15eee43
2009-09-11 16:14:09 +00:00
parent d76aadaf84
commit c0f1709c2a
4 changed files with 35 additions and 1 deletions
--- a/mozilla/webtools/bugzilla/Bugzilla/WebService/Bug.pm
+++ b/mozilla/webtools/bugzilla/Bugzilla/WebService/Bug.pm
@@ -258,6 +258,7 @@ sub search {
    }
    
    $params = _map_fields($params);
+    delete $params->{WHERE};
    
    # Do special search types for certain fields.
    if ( my $bug_when = delete $params->{delta_ts} ) {