Bug 793893: Tabular reports crash when no format parameter is defined

r=glob a=LpSolit

diff --git a/report.cgi b/report.cgi
index 1ec3ac8649d44c493dd2ec7af10b08c02e8afa27..4230ade368d4f72fb8997267af7d6b434d810eff 100755 (executable)
--- a/report.cgi
+++ b/report.cgi
@@ -84,10 +84,12 @@ if (defined($height)) {
    $height <= 2000 || ThrowUserError("chart_too_large");
 }
 
+my $formatparam = $cgi->param('format') || '';
+
 # These shenanigans are necessary to make sure that both vertical and 
 # horizontal 1D tables convert to the correct dimension when you ask to
 # display them as some sort of chart.
-if (defined $cgi->param('format') && $cgi->param('format') eq "table") {
+if ($formatparam eq "table") {
     if ($col_field && !$row_field) {    
         # 1D *tables* should be displayed vertically (with a row_field only)
         $row_field = $col_field;
@@ -210,7 +212,7 @@ $vars->{'row_names'} = \@row_names;
 $vars->{'tbl_names'} = \@tbl_names;
 
 # Below a certain width, we don't see any bars, so there needs to be a minimum.
-if ($width && $cgi->param('format') eq "bar") {
+if ($width && $formatparam eq "bar") {
     my $min_width = (scalar(@col_names) || 1) * 20;
 
     if (!$cgi->param('cumulate')) {
@@ -226,8 +228,6 @@ $vars->{'height'} = $height if $height;
 $vars->{'query'} = $query;
 $vars->{'debug'} = $cgi->param('debug');
 
-my $formatparam = $cgi->param('format');
-
 if ($action eq "wrap") {
     # So which template are we using? If action is "wrap", we will be using
     # no format (it gets passed through to be the format of the actual data),
@@ -236,7 +236,6 @@ if ($action eq "wrap") {
     # data, or images generated by calling report.cgi again with action as
     # "plot".
     $formatparam =~ s/[^a-zA-Z\-]//g;
-    trick_taint($formatparam);
     $vars->{'format'} = $formatparam;
     $formatparam = '';
 

diff --git a/template/en/default/filterexceptions.pl b/template/en/default/filterexceptions.pl
index 3e2a71e2cf9b50355922feb8c916d6c7db8f91ec..d804ad8fa0c0ec6a95ed6c70a63c77053ab83a35 100644 (file)
--- a/template/en/default/filterexceptions.pl
+++ b/template/en/default/filterexceptions.pl
@@ -106,7 +106,6 @@
   'other_format.name', 
   'sizeurl', 
   'switchbase',
-  'format',
   'cumulate',
 ],
 

diff --git a/template/en/default/reports/report.html.tmpl b/template/en/default/reports/report.html.tmpl
index d4c9d404371612e5cff6cf5dcc433b7c0d381fe1..94725ae810c6220399b24ba0794b08c8932b0f7e 100644 (file)
--- a/template/en/default/reports/report.html.tmpl
+++ b/template/en/default/reports/report.html.tmpl
@@ -170,7 +170,7 @@
       this report</a>
     [% ELSE %]
       <a href="query.cgi?[% switchbase %]&amp;chart_format=
-        [% format %]&amp;format=report-graph&amp;cumulate=[% cumulate %]">
+        [% format FILTER uri %]&amp;format=report-graph&amp;cumulate=[% cumulate %]">
         Edit this report
       </a>
     [% END %]