]> git.ipfire.org Git - thirdparty/bugzilla.git/commit
projects / thirdparty / bugzilla.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: b121584) | patch
[SECURITY] Bug 252638: It is possible to send a carefully crafted HTTP POST message...
authorjustdave%bugzilla.org <>
Mon, 25 Oct 2004 14:19:05 +0000 (14:19 +0000)
committerjustdave%bugzilla.org <>
Mon, 25 Oct 2004 14:19:05 +0000 (14:19 +0000)
commit23df77be557e495a78808769378ce1f29ac00b4f
treeb666f7f287d3276f4c50b5bd547a69e7b6a1eda8tree
parentb121584e4a4c4dd1ca7ffd1d8cdf51b8a8551a07commit | diff
[SECURITY] Bug 252638: It is possible to send a carefully crafted HTTP POST message to process_bug.cgi which will remove keywords from a bug even if you don't have permissions to edit all bug fields (the "editbugs" permission).  Such changes are reported in "bug changed" email notifications, so they are easily detected and reversed if someone abuses it.
Patch by Myk Melez <myk@mozilla.org>
r=gerv, a=justdave
process_bug.cgi diff | blob | blame | history
Mirror of https://github.com/bugzilla/bugzilla.git