diff --git a/mozilla/webtools/bugzilla/.bzrrev b/mozilla/webtools/bugzilla/.bzrrev
index 727f0f64427..6098b01698f 100644
--- a/mozilla/webtools/bugzilla/.bzrrev
+++ b/mozilla/webtools/bugzilla/.bzrrev
@@ -1 +1 @@
-8586
\ No newline at end of file
+8587
\ No newline at end of file
diff --git a/mozilla/webtools/bugzilla/Bugzilla/Template.pm b/mozilla/webtools/bugzilla/Bugzilla/Template.pm
index 81d01b4265b..f70224a9ce3 100644
--- a/mozilla/webtools/bugzilla/Bugzilla/Template.pm
+++ b/mozilla/webtools/bugzilla/Bugzilla/Template.pm
@@ -96,12 +96,15 @@ sub get_format {
     my $self = shift;
     my ($template, $format, $ctype) = @_;
 
-    $ctype ||= 'html';
-    $format ||= '';
+    $ctype //= 'html';
+    $format //= '';
 
-    # Security - allow letters and a hyphen only
-    $ctype =~ s/[^a-zA-Z\-]//g;
-    $format =~ s/[^a-zA-Z\-]//g;
+    # ctype and format can have letters and a hyphen only.
+    if ($ctype =~ /[^a-zA-Z\-]/ || $format =~ /[^a-zA-Z\-]/) {
+        ThrowUserError('format_not_found', {'format' => $format,
+                                            'ctype'  => $ctype,
+                                            'invalid' => 1});
+    }
     trick_taint($ctype);
     trick_taint($format);
 
@@ -127,6 +130,7 @@ sub get_format {
     return
     {
         'template'    => $template,
+        'format'      => $format,
         'extension'   => $ctype,
         'ctype'       => Bugzilla::Constants::contenttypes->{$ctype}
     };
diff --git a/mozilla/webtools/bugzilla/show_bug.cgi b/mozilla/webtools/bugzilla/show_bug.cgi
index 7b915795903..3956ce4b340 100755
--- a/mozilla/webtools/bugzilla/show_bug.cgi
+++ b/mozilla/webtools/bugzilla/show_bug.cgi
@@ -22,9 +22,11 @@ my $vars = {};
 
 my $user = Bugzilla->login();
 
+my $format = $template->get_format("bug/show", scalar $cgi->param('format'),
+                                   scalar $cgi->param('ctype'));
+
 # Editable, 'single' HTML bugs are treated slightly specially in a few places
-my $single = !$cgi->param('format')
-  && (!$cgi->param('ctype') || $cgi->param('ctype') eq 'html');
+my $single = !$format->{format} && $format->{extension} eq 'html';
 
 # If we don't have an ID, _AND_ we're only doing a single bug, then prompt
 if (!$cgi->param('id') && $single) {
@@ -34,9 +36,6 @@ if (!$cgi->param('id') && $single) {
     exit;
 }
 
-my $format = $template->get_format("bug/show", scalar $cgi->param('format'), 
-                                   scalar $cgi->param('ctype'));
-
 my (@bugs, @illegal_bugs);
 my %marks;
 
@@ -126,5 +125,5 @@ $vars->{'displayfields'} = \%displayfields;
 
 print $cgi->header($format->{'ctype'});
 
-$template->process("$format->{'template'}", $vars)
+$template->process($format->{'template'}, $vars)
   || ThrowTemplateError($template->error());
diff --git a/mozilla/webtools/bugzilla/template/en/default/global/user-error.html.tmpl b/mozilla/webtools/bugzilla/template/en/default/global/user-error.html.tmpl
index c9448a503f0..6d03eaa4bcf 100644
--- a/mozilla/webtools/bugzilla/template/en/default/global/user-error.html.tmpl
+++ b/mozilla/webtools/bugzilla/template/en/default/global/user-error.html.tmpl
@@ -741,7 +741,10 @@
     [% title = "Format Not Found" %]
     The requested format <em>[% format FILTER html %]</em> does not exist with
     a content type of <em>[% ctype FILTER html %]</em>.
-    
+    [% IF invalid %]
+      Both parameters must contain letters and hyphens only.
+    [% END %]
+
   [% ELSIF error == "flag_type_sortkey_invalid" %]
     [% title = "Flag Type Sort Key Invalid" %]
     The sort key <em>[% sortkey FILTER html %]</em> must be an integer