From e75fbf06724fb20c8bb409041cde2da5c66a4a97 Mon Sep 17 00:00:00 2001 From: "mkanat%bugzilla.org" Date: Mon, 24 Jan 2011 18:31:15 +0000 Subject: [PATCH] Bug 621572: (CVE-2010-4572) [SECURITY] chart.cgi vulnerable to header-injection due to use of |print "Location:"| instead of $cgi->redirect [r=mkanat a=LpSolit] git-svn-id: svn://10.0.0.236/branches/BUGZILLA-4_0-BRANCH@261812 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/webtools/bugzilla/.bzrrev | 2 +- mozilla/webtools/bugzilla/chart.cgi | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/mozilla/webtools/bugzilla/.bzrrev b/mozilla/webtools/bugzilla/.bzrrev index a0932ad4995..53d90c79e2d 100644 --- a/mozilla/webtools/bugzilla/.bzrrev +++ b/mozilla/webtools/bugzilla/.bzrrev @@ -1 +1 @@ -7529 \ No newline at end of file +7530 \ No newline at end of file diff --git a/mozilla/webtools/bugzilla/chart.cgi b/mozilla/webtools/bugzilla/chart.cgi index a04cde06829..e7a0f5e8bf9 100755 --- a/mozilla/webtools/bugzilla/chart.cgi +++ b/mozilla/webtools/bugzilla/chart.cgi @@ -74,8 +74,8 @@ if (!Bugzilla->feature('new_charts')) { # Go back to query.cgi if we are adding a boolean chart parameter. if (grep(/^cmd-/, $cgi->param())) { my $params = $cgi->canonicalise_query("format", "ctype", "action"); - print "Location: query.cgi?format=" . $cgi->param('query_format') . - ($params ? "&$params" : "") . "\n\n"; + print $cgi->redirect("query.cgi?format=" . $cgi->param('query_format') . + ($params ? "&$params" : "")); exit; } @@ -98,7 +98,7 @@ $action ||= "assemble"; # Go to buglist.cgi if we are doing a search. if ($action eq "search") { my $params = $cgi->canonicalise_query("format", "ctype", "action"); - print "Location: buglist.cgi" . ($params ? "?$params" : "") . "\n\n"; + print $cgi->redirect("buglist.cgi" . ($params ? "?$params" : "")); exit; }