Patch by Dru Nelson <dnelson@redwoodsoft.com> -- quote the

logincookie, just in case some silly user mucked with their cookie file.

diff --git a/CGI.pl b/CGI.pl
index 3f3ed82b422ae5131ddcdb4aa931598067670736..74d383646f76213f8abace851062f680e37560aa 100644 (file)
--- a/CGI.pl
+++ b/CGI.pl
@@ -244,7 +244,7 @@ sub quietly_check_login() {
                "and logincookies.hostname = " .
                SqlQuote($ENV{"REMOTE_HOST"}) .
                " from profiles,logincookies where logincookies.cookie = " .
-               $::COOKIE{"Bugzilla_logincookie"} .
+               SqlQuote($::COOKIE{"Bugzilla_logincookie"}) .
                " and profiles.userid = logincookies.userid");
         my @row;
         if (@row = FetchSQLData()) {