From c24e7e6db380db13fcf82608046fe4ca8c9df93b Mon Sep 17 00:00:00 2001 From: "karl%kornel.name" Date: Tue, 13 Dec 2005 20:03:13 +0000 Subject: [PATCH] Bug 313679: Changing email address in sudo mode logs user in as impersonated user - Patch by A. Karl Kornel r=wurblzap a=justdave git-svn-id: svn://10.0.0.236/trunk@186009 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/webtools/bugzilla/userprefs.cgi | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/mozilla/webtools/bugzilla/userprefs.cgi b/mozilla/webtools/bugzilla/userprefs.cgi index 24c9136f435..a5590e4eb43 100755 --- a/mozilla/webtools/bugzilla/userprefs.cgi +++ b/mozilla/webtools/bugzilla/userprefs.cgi @@ -420,9 +420,11 @@ sub SaveSavedSearches { my $cgi = Bugzilla->cgi; # This script needs direct access to the username and password CGI variables, -# so we save them before their removal in Bugzilla->login +# so we save them before their removal in Bugzilla->login, and delete them +# prior to login if we might possibly be in an sudo session. my $bugzilla_login = $cgi->param('Bugzilla_login'); my $bugzilla_password = $cgi->param('Bugzilla_password'); +$cgi->delete('Bugzilla_login', 'Bugzilla_password') if ($cgi->cookie('sudo')); Bugzilla->login(LOGIN_REQUIRED); $cgi->param('Bugzilla_login', $bugzilla_login);