From: Max Kanat-Alexander Date: Thu, 4 Aug 2011 20:02:26 +0000 (+0200) Subject: Bug 660053: (CVE-2011-2976) [SECURITY] If a BUGLIST cookie is compromised, it can... X-Git-Tag: bugzilla-3.4.12~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5a451ce5715d9cf07abfc796f39fed9e58507532;p=thirdparty%2Fbugzilla.git Bug 660053: (CVE-2011-2976) [SECURITY] If a BUGLIST cookie is compromised, it can be used to XSS show_bug.cgi and inject HTML into r/a=LpSolit --- diff --git a/template/en/default/bug/navigate.html.tmpl b/template/en/default/bug/navigate.html.tmpl index 7b8f3c8274..769692c572 100644 --- a/template/en/default/bug/navigate.html.tmpl +++ b/template/en/default/bug/navigate.html.tmpl @@ -44,22 +44,24 @@ [% END %] [% IF this_bug_idx != -1 %] - First - Last + First + Last [% END %] [% IF bug.bug_id %] [% IF this_bug_idx != -1 %] [% IF this_bug_idx > 0 %] [% prev_bug = this_bug_idx - 1 %] - Prev + Prev [% ELSE %] Prev [% END %] [% IF this_bug_idx + 1 < bug_list.size %] [% next_bug = this_bug_idx + 1 %] - Next + Next [% ELSE %] Next [% END %] diff --git a/template/en/default/filterexceptions.pl b/template/en/default/filterexceptions.pl index 809ca77724..4e83aeaad3 100644 --- a/template/en/default/filterexceptions.pl +++ b/template/en/default/filterexceptions.pl @@ -250,10 +250,6 @@ ], 'global/site-navigation.html.tmpl' => [ - 'bug_list.first', - 'bug_list.$prev_bug', - 'bug_list.$next_bug', - 'bug_list.last', 'bug.bug_id', 'bug.votes', ], @@ -300,13 +296,6 @@ '" spellcheck=\"$spellcheck\"" IF spellcheck', ], -'bug/navigate.html.tmpl' => [ - 'bug_list.first', - 'bug_list.last', - 'bug_list.$prev_bug', - 'bug_list.$next_bug', -], - 'bug/show-multiple.html.tmpl' => [ 'attachment.id', 'flag.status', diff --git a/template/en/default/global/site-navigation.html.tmpl b/template/en/default/global/site-navigation.html.tmpl index 5440fe1f88..d8f9cd9869 100644 --- a/template/en/default/global/site-navigation.html.tmpl +++ b/template/en/default/global/site-navigation.html.tmpl @@ -36,8 +36,10 @@ [% IF bug_list && bug_list.size > 0 %] - - + + [% IF bug && bug.bug_id %] [% current_bug_idx = lsearch(bug_list, bug.bug_id) %] @@ -45,12 +47,14 @@ [% IF current_bug_idx > 0 %] [% prev_bug = current_bug_idx - 1 %] - + [% END %] [% IF current_bug_idx + 1 < bug_list.size %] [% next_bug = current_bug_idx + 1 %] - + [% END %] [% END %]