Bug 824399: (CVE-2013-0786) [SECURITY] build_subselect() leaks the existence of produ...

r/a=LpSolit

diff --git a/Bugzilla/Config/GroupSecurity.pm b/Bugzilla/Config/GroupSecurity.pm
index f7f717379d591977f9655f1845dc408040fd65ff..6296583d95cb0b72b6e8ab768b54cb4f5d8045c4 100644 (file)
--- a/Bugzilla/Config/GroupSecurity.pm
+++ b/Bugzilla/Config/GroupSecurity.pm
@@ -80,6 +80,14 @@ sub get_param_list {
    checker => \&check_group
   },
   
+  {
+   name => 'debug_group',
+   type => 's',
+   choices => \&_get_all_group_names,
+   default => 'admin',
+   checker => \&check_group
+  },
+  
   {
    name => 'usevisibilitygroups',
    type => 'b',

diff --git a/buglist.cgi b/buglist.cgi
index c1b620b76fff1582d338562e6a1dd6f6c7967678..dabf2d52e8ba013cf829d42fae0c979e4511e7c8 100755 (executable)
--- a/buglist.cgi
+++ b/buglist.cgi
@@ -867,7 +867,10 @@ elsif ($fulltext) {
 # Query Execution
 ################################################################################
 
-if ($cgi->param('debug')) {
+if ($cgi->param('debug')
+    && Bugzilla->params->{debug_group}
+    && Bugzilla->user->in_group(Bugzilla->params->{debug_group})
+) {
     $vars->{'debug'} = 1;
     $vars->{'query'} = $query;
     # Explains are limited to admins because you could use them to figure

diff --git a/report.cgi b/report.cgi
index 18bed40a0dd0769cf24057cc5877c410be285a55..cd9863de8508dbfdd0b3a6e5a39f158ef6115b1e 100755 (executable)
--- a/report.cgi
+++ b/report.cgi
@@ -243,7 +243,13 @@ $vars->{'width'} = $width if $width;
 $vars->{'height'} = $height if $height;
 
 $vars->{'query'} = $query;
-$vars->{'debug'} = $cgi->param('debug');
+
+if ($cgi->param('debug')
+    && Bugzilla->params->{debug_group}
+    && Bugzilla->user->in_group(Bugzilla->params->{debug_group})
+) {
+    $vars->{'debug'} = 1;
+}
 
 my $formatparam = $cgi->param('format');
 

diff --git a/template/en/default/admin/params/groupsecurity.html.tmpl b/template/en/default/admin/params/groupsecurity.html.tmpl
index ab39a914999133c8fdaac0b957da8ef111f9c30a..783099a11ded0289412b7bd4d92268b73f89b0bf 100644 (file)
--- a/template/en/default/admin/params/groupsecurity.html.tmpl
+++ b/template/en/default/admin/params/groupsecurity.html.tmpl
@@ -42,6 +42,9 @@
   querysharegroup => "The name of the group of users who can share their " _
                      "saved searches with others.",
 
+  debug_group => "The name of the group of users who can view the actual " _
+                 "SQL query generated when viewing $terms.bug lists and reports.",
+
   usevisibilitygroups => "Do you wish to restrict visibility of users to members of " _
                          "specific groups?",