Bug 463688: editusers.cgi no longer lets you search for users using regular expressio...

diff --git a/Bugzilla/DB.pm b/Bugzilla/DB.pm
index 03e8e4de35aee8e3d940adc446285f59d8f06910..377f839300f30b99cb0836b208e2093e127d8c6a 100644 (file)
--- a/Bugzilla/DB.pm
+++ b/Bugzilla/DB.pm
@@ -1556,6 +1556,11 @@ Abstract method, should be overridden by database specific code.
 
 =item C<$pattern> - the regular expression to search for (scalar)
 
+=item C<$nocheck> - true if the pattern should not be tested; false otherwise (boolean)
+
+=item C<$real_pattern> - the real regular expression to search for.
+This argument is used when C<$pattern> is a placeholder ('?').
+
 =back
 
 =item B<Returns>
@@ -1578,13 +1583,7 @@ Abstract method, should be overridden by database specific code.
 
 =item B<Params>
 
-=over
-
-=item C<$expr> - SQL expression for the text to be searched (scalar)
-
-=item C<$pattern> - the regular expression to search for (scalar)
-
-=back
+Same as L</sql_regexp>.
 
 =item B<Returns>
 

diff --git a/Bugzilla/DB/Mysql.pm b/Bugzilla/DB/Mysql.pm
index 92263af9d235ae03c417fc8789e4878a05963f2b..c9a80a93dfec7dbb2460c30c085fb95fbf651d35 100644 (file)
--- a/Bugzilla/DB/Mysql.pm
+++ b/Bugzilla/DB/Mysql.pm
@@ -136,17 +136,19 @@ sub sql_group_concat {
 }
 
 sub sql_regexp {
-    my ($self, $expr, $pattern, $nocheck) = @_;
+    my ($self, $expr, $pattern, $nocheck, $real_pattern) = @_;
+    $real_pattern ||= $pattern;
 
-    $self->bz_check_regexp($pattern) if !$nocheck;
+    $self->bz_check_regexp($real_pattern) if !$nocheck;
 
     return "$expr REGEXP $pattern";
 }
 
 sub sql_not_regexp {
-    my ($self, $expr, $pattern, $nocheck) = @_;
+    my ($self, $expr, $pattern, $nocheck, $real_pattern) = @_;
+    $real_pattern ||= $pattern;
 
-    $self->bz_check_regexp($pattern) if !$nocheck;
+    $self->bz_check_regexp($real_pattern) if !$nocheck;
 
     return "$expr NOT REGEXP $pattern";
 }

diff --git a/Bugzilla/DB/Oracle.pm b/Bugzilla/DB/Oracle.pm
index 854b72a436e170337e63060accb87ff76517f074..833fce635315472a64b868daeb8a3f53c879db9c 100644 (file)
--- a/Bugzilla/DB/Oracle.pm
+++ b/Bugzilla/DB/Oracle.pm
@@ -99,7 +99,7 @@ sub bz_check_regexp {
     my ($self, $pattern) = @_;
 
     eval { $self->do("SELECT 1 FROM DUAL WHERE "
-          . $self->sql_regexp($self->quote("a"), $self->quote($pattern), 1)) };
+          . $self->sql_regexp($self->quote("a"), $pattern, 1)) };
 
     $@ && ThrowUserError('illegal_regexp',
         { value => $pattern, dberror => $self->errstr });
@@ -115,17 +115,19 @@ sub bz_explain {
 } 
 
 sub sql_regexp {
-    my ($self, $expr, $pattern, $nocheck) = @_;
+    my ($self, $expr, $pattern, $nocheck, $real_pattern) = @_;
+    $real_pattern ||= $pattern;
 
-    $self->bz_check_regexp($pattern) if !$nocheck;
+    $self->bz_check_regexp($real_pattern) if !$nocheck;
 
     return "REGEXP_LIKE($expr, $pattern)";
 }
 
 sub sql_not_regexp {
-    my ($self, $expr, $pattern, $nocheck) = @_;
+    my ($self, $expr, $pattern, $nocheck, $real_pattern) = @_;
+    $real_pattern ||= $pattern;
 
-    $self->bz_check_regexp($pattern) if !$nocheck;
+    $self->bz_check_regexp($real_pattern) if !$nocheck;
 
     return "NOT REGEXP_LIKE($expr, $pattern)" 
 }

diff --git a/Bugzilla/DB/Pg.pm b/Bugzilla/DB/Pg.pm
index d06decaa34de51c05a7825c36e336e8fdb5cc1e2..66ad4b1ecd7991a8bec114b6caba70cd842fa891 100644 (file)
--- a/Bugzilla/DB/Pg.pm
+++ b/Bugzilla/DB/Pg.pm
@@ -93,17 +93,19 @@ sub bz_last_key {
 }
 
 sub sql_regexp {
-    my ($self, $expr, $pattern, $nocheck) = @_;
+    my ($self, $expr, $pattern, $nocheck, $real_pattern) = @_;
+    $real_pattern ||= $pattern;
 
-    $self->bz_check_regexp($pattern) if !$nocheck;
+    $self->bz_check_regexp($real_pattern) if !$nocheck;
 
     return "$expr ~* $pattern";
 }
 
 sub sql_not_regexp {
-    my ($self, $expr, $pattern, $nocheck) = @_;
+    my ($self, $expr, $pattern, $nocheck, $real_pattern) = @_;
+    $real_pattern ||= $pattern;
 
-    $self->bz_check_regexp($pattern) if !$nocheck;
+    $self->bz_check_regexp($real_pattern) if !$nocheck;
 
     return "$expr !~* $pattern" 
 }

diff --git a/editusers.cgi b/editusers.cgi
index 23adb6eb753e1914cf08dbf49f8b3fa892769659..6dac967886550d824e4bafdf1ef232c9493cf936 100755 (executable)
--- a/editusers.cgi
+++ b/editusers.cgi
@@ -136,23 +136,28 @@ if ($action eq 'search') {
             } else {
                 $expr = "profiles.login_name";
             }
+
+            if ($matchstr =~ /^(regexp|notregexp|exact)$/) {
+                $matchstr ||= '.';
+            }
+            else {
+                $matchstr = '' unless defined $matchstr;
+            }
+            # We can trick_taint because we use the value in a SELECT only,
+            # using a placeholder.
+            trick_taint($matchstr);
+
             if ($matchtype eq 'regexp') {
-                $query .= $dbh->sql_regexp($expr, '?');
-                $matchstr = '.' unless $matchstr;
+                $query .= $dbh->sql_regexp($expr, '?', 0, $dbh->quote($matchstr));
             } elsif ($matchtype eq 'notregexp') {
-                $query .= $dbh->sql_not_regexp($expr, '?');
-                $matchstr = '.' unless $matchstr;
+                $query .= $dbh->sql_not_regexp($expr, '?', 0, $dbh->quote($matchstr));
             } elsif ($matchtype eq 'exact') {
                 $query .= $expr . ' = ?';
-                $matchstr = '.' unless $matchstr;
             } else { # substr or unknown
                 $query .= $dbh->sql_istrcmp($expr, '?', 'LIKE');
                 $matchstr = "%$matchstr%";
             }
             $nextCondition = 'AND';
-            # We can trick_taint because we use the value in a SELECT only,
-            # using a placeholder.
-            trick_taint($matchstr);
             push(@bindValues, $matchstr);
         }