Bug 165221: Apostrophes not properly handled during account creation. r=joel,r2=bbaetz

diff --git a/createaccount.cgi b/createaccount.cgi
index 8a5b85782be920ff95fa86f47cf8a590d9c56390..e409f28b87e5c9c1d45d6beaff35de925d72d2ba 100755 (executable)
--- a/createaccount.cgi
+++ b/createaccount.cgi
@@ -66,7 +66,6 @@ if (defined($login)) {
     # We've been asked to create an account.
     my $realname = trim($::FORM{'realname'});
     CheckEmailSyntax($login);
-    trick_taint($login);
     $vars->{'login'} = $login;
     
     if (!ValidateNewUser($login)) {

diff --git a/globals.pl b/globals.pl
index ee0e4f1538555f4d0bee7a49811937f3be2263ad..94939e19d4022e5ebe0b0cd6c1991d4ab4c4f9e2 100644 (file)
--- a/globals.pl
+++ b/globals.pl
@@ -646,11 +646,19 @@ sub ValidateNewUser {
         return 0;
     }
 
+    my $sqluname = SqlQuote($username);
+
     # Reject if the new login is part of an email change which is 
     # still in progress
+    #
+    # substring/locate stuff: bug 165221; this used to use regexes, but that
+    # was unsafe and required weird escaping; using substring to pull out
+    # the new/old email addresses and locate() to find the delimeter (':')
+    # is cleaner/safer
     SendSQL("SELECT eventdata FROM tokens WHERE tokentype = 'emailold' 
-                AND eventdata like '%:$username' 
-                 OR eventdata like '$username:%'");
+     AND SUBSTRING(eventdata, 1, (LOCATE(':', eventdata) - 1)) = $sqluname 
+     OR SUBSTRING(eventdata, (LOCATE(':', eventdata) + 1)) = $sqluname");
+
     if (my ($eventdata) = FetchSQLData()) {
         # Allow thru owner of token
         if($old_username && ($eventdata eq "$old_username:$username")) {