From e8dec5a6f55aed0746847451567623208ce05fcf Mon Sep 17 00:00:00 2001 From: "justdave%syndicomm.com" Date: Thu, 25 Jul 2002 01:47:50 +0000 Subject: [PATCH] Fix for bug 154008: some basic (but incomplete) maintenance on bug_email.pl, also fixes a possible security hole with a misuse of a system() call. Patches by Erik Anderson and Brad Baetz r= myk, justdave git-svn-id: svn://10.0.0.236/branches/BUGZILLA-2_16-BRANCH@125758 18797224-902f-48f8-a5cc-f745e15eee43 --- .../webtools/bugzilla/contrib/bug_email.pl | 22 +++++++++++++------ .../bugzilla/contrib/bugzilla_email_append.pl | 11 ++++++---- 2 files changed, 22 insertions(+), 11 deletions(-) diff --git a/mozilla/webtools/bugzilla/contrib/bug_email.pl b/mozilla/webtools/bugzilla/contrib/bug_email.pl index da65cf7be51..aaab4bba309 100755 --- a/mozilla/webtools/bugzilla/contrib/bug_email.pl +++ b/mozilla/webtools/bugzilla/contrib/bug_email.pl @@ -37,7 +37,7 @@ # # You need to work with bug_email.pl the MIME::Parser installed. # -# $Id: bug_email.pl,v 1.9 2001-05-25 12:48:47 jake%acutex.net Exp $ +# $Id: bug_email.pl,v 1.9.12.1 2002-07-25 01:47:33 justdave%syndicomm.com Exp $ ############################################################### # 02/12/2000 (SML) @@ -70,7 +70,9 @@ use diagnostics; use strict; use MIME::Parser; -push @INC, "../."; # this script now lives in contrib +chdir '..'; # this script lives in contrib +push @INC, "contrib/."; +push @INC, "."; require "globals.pl"; require "BugzillaEmail.pm"; @@ -736,10 +738,10 @@ my $parser = new MIME::Parser; # Create and set the output directory: # FIXME: There should be a $BUGZILLA_HOME variable (SML) -(-d "../data/mimedump-tmp") or mkdir "../data/mimedump-tmp",0755 or die "mkdir: $!"; -(-w "../data/mimedump-tmp") or die "can't write to directory"; +(-d "data/mimedump-tmp") or mkdir "data/mimedump-tmp",0755 or die "mkdir: $!"; +(-w "data/mimedump-tmp") or die "can't write to directory"; -$parser->output_dir("../data/mimedump-tmp"); +$parser->output_dir("data/mimedump-tmp"); # Read the MIME message: my $entity = $parser->read(\*STDIN) or die "couldn't parse MIME stream"; @@ -1233,8 +1235,14 @@ END my $long_desc_query = "INSERT INTO longdescs SET bug_id=$id, who=$userid, bug_when=\'$bug_when\', thetext=" . SqlQuote($comment); SendSQL($long_desc_query); - # Cool, the mail was successfull - system("cd .. ; ./processmail $id '$Sender'"); + # Cool, the mail was successful + # chdir back to the main directory which has the processmail script + # Oh, for a processmail module.... + use Cwd; + my $old_cwd = getcwd(); + chdir(".."); + system("./processmail", $id, $SenderShort); + chdir($old_cwd); } else { $id = 0xFFFF; # TEST ! print "\n-------------------------------------------------------------------------\n"; diff --git a/mozilla/webtools/bugzilla/contrib/bugzilla_email_append.pl b/mozilla/webtools/bugzilla/contrib/bugzilla_email_append.pl index b10d8e03087..826b49198f2 100755 --- a/mozilla/webtools/bugzilla/contrib/bugzilla_email_append.pl +++ b/mozilla/webtools/bugzilla/contrib/bugzilla_email_append.pl @@ -32,7 +32,9 @@ use diagnostics; use strict; use MIME::Parser; -push @INC, "../."; # this script lives in contrib +chdir ".."; # this script lives in contrib, change to main +push @INC, "contrib"; +push @INC, "."; # this script lives in contrib require "globals.pl"; require "BugzillaEmail.pm"; @@ -43,10 +45,10 @@ my $Comment = ""; # Create and set the output directory: # FIXME: There should be a $BUGZILLA_HOME variable (SML) -(-d "../data/mimedump-tmp") or mkdir "../data/mimedump-tmp",0755 or die "mkdir: $!"; -(-w "../data/mimedump-tmp") or die "can't write to directory"; +(-d "data/mimedump-tmp") or mkdir "data/mimedump-tmp",0755 or die "mkdir: $!"; +(-w "data/mimedump-tmp") or die "can't write to directory"; -$parser->output_dir("../data/mimedump-tmp"); +$parser->output_dir("data/mimedump-tmp"); # Read the MIME message: my $entity = $parser->read(\*STDIN) or die "couldn't parse MIME stream"; @@ -120,6 +122,7 @@ system("cd .. ; ./processmail $found_id '$SenderShort'"); sub DealWithError { my ($reason) = @_; print $reason . "\n"; + exit 100; } # Yanking this wholesale from bug_email, 'cause I know this works. I'll