Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 621572: (CVE-2010-4572) [SECURITY] chart.cgi vulnerable to header-injection due to use of |print "Location:"| instead of $cgi->redirect

Browse Source 
[r=mkanat a=LpSolit]


git-svn-id: svn://10.0.0.236/branches/BUGZILLA-4_0-BRANCH@261812 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
mkanat%bugzilla.org
2011-01-24 18:31:15 +00:00
parent 5facb5e3fd
commit e75fbf0672
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
mozilla/webtools/bugzilla/.bzrrev
View File

@@ -1 +1 @@
7529
7530

6
mozilla/webtools/bugzilla/chart.cgi
View File

@@ -74,8 +74,8 @@ if (!Bugzilla->feature('new_charts')) {
# Go back to query.cgi if we are adding a boolean chart parameter.
if (grep(/^cmd-/, $cgi->param())) {
my $params = $cgi->canonicalise_query("format", "ctype", "action");
print "Location: query.cgi?format=" . $cgi->param('query_format') .
($params ? "&$params" : "") . "\n\n";
print $cgi->redirect("query.cgi?format=" . $cgi->param('query_format') .
($params ? "&$params" : ""));
exit;
}
@@ -98,7 +98,7 @@ $action ||= "assemble";
# Go to buglist.cgi if we are doing a search.
if ($action eq "search") {
my $params = $cgi->canonicalise_query("format", "ctype", "action");
print "Location: buglist.cgi" . ($params ? "?$params" : "") . "\n\n";
print $cgi->redirect("buglist.cgi" . ($params ? "?$params" : ""));
exit;
}