Bug 619594: (CVE-2010-4568) [SECURITY] Improve the randomness of
generate_random_password, to protect against an account compromise issue
and other critical vulnerabilities.
r=LpSolit, a=LpSolit
Frédéric Buclin [Mon, 24 Jan 2011 18:38:50 +0000 (19:38 +0100)]
Bug 619588: (CVE-2010-4567) [SECURITY] Safety checks that disallow clicking for javascript: or data: URLs in the URL field can be evaded with prefixed whitespace
and
Bug 628034: (CVE-2011-0048) [SECURITY] For not-logged-in users, the URL field doesn't safeguard against javascript: or data: URLs
Reed Loden [Mon, 24 Jan 2011 18:15:04 +0000 (10:15 -0800)]
Bug 621572: (CVE-2010-4572) [SECURITY] chart.cgi vulnerable to header-injection due to use of |print "Location:"| instead of $cgi->redirect
[r=mkanat a=LpSolit]
Reed Loden [Fri, 21 Jan 2011 21:17:43 +0000 (13:17 -0800)]
Bug 591165: (CVE-2010-4411) [SECURITY] Bump minimum required version of CGI.pm to v3.51 in order to address header injection vulnerability.
[r=mkanat a=mkanat]
Frédéric Buclin [Wed, 4 Aug 2010 22:15:55 +0000 (00:15 +0200)]
Bug 583690: (CVE-2010-2759) [SECURITY][PostgreSQL] Bugzilla crashes when viewing a bug if a comment contains 'bug <num>' or 'attachment <num>' where <num> is greater than the max allowed integer
r=mkanat a=LpSolit
Bug 309952: (CVE-2010-1204) [SECURITY] Protect boolean chart searches for
time-tracking fields from being used by users who are not in the
timetrackinggroup.
r=LpSolit, a=mkanat
Bug 498309: Speed up show_bug when there are many comments by caching the
results of get_text calls in Bugzilla::Template, and removing the call
to field-descs.none.tmpl from format_comment.txt.tmpl.
r=LpSolit, a=LpSolit
Remove CVS "$Id" markers in files. The CVS mirror of bzr was showing
the docs' about.xml and installation.xml being modified on every commit
because of these markers, and the rest of them are simply unnecessary.
David Lawrence [Fri, 5 Mar 2010 18:49:28 +0000 (13:49 -0500)]
Bug 513989 - large search query causing internal server error (500) but valid redirect 302 returned
Decreased CGI_URI_LIMIT to 8000 instead of 10000
a=mkanat
Some lines in the release notes started with a "[% terms" item but didn't
have [%+ on them, so the words would get crunched together, like "thisBugzilla".
Bug 538211: Make value-controlled and visibility-controlled fields behave
correctly on enter_bug.cgi when the user uses a bookmarkable template to
pre-fill values in the controller.
r=LpSolit, a=LpSolit
Bug 520993: If the "FIXED" resolution was a visibility or value controller,
then controlled fields weren't properly changing when the status changed to
RESOLVED and "FIXED" appeared as the first value in the Resolution field.
r=LpSolit, a=mkanat
Fix the data in the bzr repo to match the data in the CVS repo.
During the CVS imports into Bzr, there were some inconsistencies introduced
(mostly that files that were deleted in CVS weren't being deleted in Bzr).
So this checkin makes the bzr repo actually consistent with the CVS repo,
including fixing permissions of files.
Bug 314871: (CVE-2009-3989) [SECURITY] Prevent web browsers from accessing CVS/, contrib/, docs/, and t/ directories
Patch by Max Kanat-Alexander <mkanat@bugzilla.org> r=LpSolit, a=LpSolit
Frédéric Buclin [Mon, 1 Feb 2010 21:21:21 +0000 (13:21 -0800)]
Bug 532493: [SECURITY] Restricting a bug to a group while moving it to another product has no effect if the group is not used by both products
Patch by Frédéric Buclin <LpSolit@gmail.com> r=mkanat a=LpSolit
Frédéric Buclin [Mon, 1 Feb 2010 20:49:32 +0000 (12:49 -0800)]
Bug 533363: [PostgreSQL] Using "Bug ID contains foo" in boolean charts or "Exclude bug numbered" charts crash PostgreSQL 8.3 and newer (non-character data types are no longer automatically cast to TEXT)
Patch by Frédéric Buclin <LpSolit@gmail.com> r/a=mkanat
Bug 480968: Make checksetup.pl never show popup windows for errors, on Windows, to work around the error that pops up every time it tries to load DBD::Oracle.
Patch by Max Kanat-Alexander <mkanat@bugzilla.org> r=Wurblzap, a=mkanat
After the checkin of bug 524603, checksetup.pl printed "No such file or directory at Bugzilla/Install/Filesystem.pm line 465" the first time the new code was run. This fixes the warning.
Bug 524603: Allow a non-root jobqueue.pl to write to data/mailer.testfile (for the "Test" mail_delivery_method)
Patch by Max Kanat-Alexander <mkanat@bugzilla.org> r=LpSolit, a=LpSolit
Bug 531500: Allow the mailer-before_send hook to modify the arguments passed to Email::Send
Patch by Max Kanat-Alexander <mkanat@bugzilla.org> r=dkl, a=mkanat
projects / thirdparty / bugzilla.git / log
