Bug 237627: Validate dataset name in reports.cgi

patch by teemu
r=justdave
a=justdave

diff --git a/reports.cgi b/reports.cgi
index 01ce9927724b30bd2795c1aa6619e68352402582..685b16418d82e5f204e5d672f793732fb1b22296 100755 (executable)
--- a/reports.cgi
+++ b/reports.cgi
@@ -234,7 +234,7 @@ sub chart_image_name {
     # Instead, just require that each field name consists only of letters
     # and number
 
-    if ($datasets !~ m/[A-Za-z0-9:]/) {
+    if ($datasets !~ m/^[A-Za-z0-9:]+$/) {
         die "Invalid datasets $datasets";
     }