Bug 653477: (CVE-2011-2380) [SECURITY] Group names can be guessed when creating or...

r=dkl a=LpSolit

diff --git a/Bugzilla/Bug.pm b/Bugzilla/Bug.pm
index 290bd0b69a94b9fc60d70d483ee1711ed163fb90..57094c955e9dc361e76c617073906fa1960724e2 100644 (file)
--- a/Bugzilla/Bug.pm
+++ b/Bugzilla/Bug.pm
@@ -1371,7 +1371,7 @@ sub _check_groups {
             || ThrowUserError("invalid_group_ID");
 
         # This can only happen if somebody hacked the enter_bug form.
-        ThrowCodeError("inactive_group", { name => $group->name })
+        ThrowCodeError("inactive_group", { group_id => $id })
             unless $group->is_active;
 
         my $membercontrol = $controls->{$id}

diff --git a/template/en/default/global/code-error.html.tmpl b/template/en/default/global/code-error.html.tmpl
index 4f5ba27f447dc8edc55d9eacd833bd5e7ed6f4cd..efb5de6f1d001749a72c9745ce3dfe4bfaad7fb5 100644 (file)
--- a/template/en/default/global/code-error.html.tmpl
+++ b/template/en/default/global/code-error.html.tmpl
@@ -175,8 +175,8 @@
     A legal [% field FILTER html %] was not set.
 
   [% ELSIF error == "inactive_group" %]
-    Attempted to add [% terms.bug %] to the '[% name FILTER html %]'
-    group, which is not used for [% terms.bugs %].
+    Attempted to add [% terms.abug %] to group ID [% group_id FILTER html %],
+    which is not used for [% terms.bugs %].
 
   [% ELSIF error == "invalid_attach_id_to_obsolete" %]
      The attachment number of one of the attachments you wanted to obsolete,