From: Frédéric Buclin <LpSolit@gmail.com>
Date: Fri, 25 Sep 2015 18:35:20 +0000 (+0200)
Subject: Bug 1089448: Strawberry Perl throws a "Insecure dependency in sysopen" error when... 
X-Git-Tag: release-5.0.2~32
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a326cd5545b36f7a59e1912494959a0932250263;p=thirdparty%2Fbugzilla.git

Bug 1089448: Strawberry Perl throws a "Insecure dependency in sysopen" error when attaching a file
r=gerv a=dkl
---

diff --git a/Bugzilla.pm b/Bugzilla.pm
index e3184fdb81..3f4d31101b 100644
--- a/Bugzilla.pm
+++ b/Bugzilla.pm
@@ -87,6 +87,14 @@ sub init_page {
         # Some modules throw undefined errors (notably File::Spec::Win32) if
         # PATH is undefined.
         $ENV{'PATH'} = '';
+        # On Windows, these paths are tainted, preventing File::Spec::Win32->tmpdir
+        # from using them. But we need a place to temporary store attachments
+        # which are uploaded.
+        if (ON_WINDOWS) {
+            foreach my $temp (qw(TMPDIR TMP TEMP)) {
+                trick_taint($ENV{$temp}) if $ENV{$temp};
+            }
+        }
     }
 
     # Because this function is run live from perl "use" commands of