Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 494369: Do not throw an error if the 'order' parameter contains invalid columns for buglists - Patch by Frédéric Buclin <LpSolit@gmail.com> r=wicked a=LpSolit

Browse Source 
git-svn-id: svn://10.0.0.236/trunk@257283 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
lpsolit%gmail.com
2009-05-25 16:59:23 +00:00
parent 516e9e3790
commit fef7af0306
3 changed files with 12 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
mozilla/webtools/bugzilla/buglist.cgi
View File

@@ -165,7 +165,6 @@ my $serverpush =
|| $cgi->param('serverpush');
my $order = $cgi->param('order') || "";
my $order_from_cookie = 0; # True if $order set using the LASTORDER cookie
# The params object to use for the actual query itself
my $params;
@@ -890,8 +889,6 @@ if (!$order || $order =~ /^reuse/i) {
# Cookies from early versions of Specific Search included this text,
# which is now invalid.
$order =~ s/ LIMIT 200//;
$order_from_cookie = 1;
}
else {
$order = ''; # Remove possible "reuse" identifier as unnecessary
@@ -920,7 +917,7 @@ if ($order) {
last ORDER;
};
do {
my @order;
my (@order, @invalid_fragments);
my @columnnames = map($columns->{lc($_)}->{'name'}, keys(%$columns));
# A custom list of columns. Make sure each column is valid.
foreach my $fragment (split(/,/, $order)) {
@@ -933,16 +930,14 @@ if ($order) {
push(@order, $fragment);
}
else {
my $vars = { fragment => $fragment };
if ($order_from_cookie) {
$cgi->remove_cookie('LASTORDER');
ThrowCodeError("invalid_column_name_cookie", $vars);
}
else {
ThrowCodeError("invalid_column_name_form", $vars);
}
push(@invalid_fragments, $fragment);
}
}
if (scalar @invalid_fragments) {
$vars->{'message'} = 'invalid_column_name';
$vars->{'invalid_fragments'} = \@invalid_fragments;
}
$order = join(",", @order);
# Now that we have checked that all columns in the order are valid,
# detaint the order string.