Bug 660053: (CVE-2011-2976) [SECURITY] If a BUGLIST cookie is compromised, it can...

r/a=LpSolit

diff --git a/template/en/default/bug/navigate.html.tmpl b/template/en/default/bug/navigate.html.tmpl
index 7b8f3c827400503a546ff0bfdd5691d1fb287703..769692c5725a67c5c980c2b9c68e2db233fb85ad 100644 (file)
--- a/template/en/default/bug/navigate.html.tmpl
+++ b/template/en/default/bug/navigate.html.tmpl
@@ -44,22 +44,24 @@
   [% END %]
 
 [% IF this_bug_idx != -1 %]
-  <a href="show_bug.cgi?id=[% bug_list.first %]">First</a>
-  <a href="show_bug.cgi?id=[% bug_list.last %]">Last</a>
+  <a href="show_bug.cgi?id=[% bug_list.first FILTER url_quote %]">First</a>
+  <a href="show_bug.cgi?id=[% bug_list.last FILTER url_quote %]">Last</a>
 [% END %]
 
   [% IF bug.bug_id %]
     [% IF this_bug_idx != -1 %]
       [% IF this_bug_idx > 0 %]
         [% prev_bug = this_bug_idx - 1 %]
-        <a href="show_bug.cgi?id=[% bug_list.$prev_bug %]">Prev</a>
+        <a href="show_bug.cgi?id=
+                 [%- bug_list.$prev_bug FILTER url_quote %]">Prev</a>
       [% ELSE %]
         <i><font color="#777777">Prev</font></i>
       [% END %]
 
       [% IF this_bug_idx + 1 < bug_list.size %]
         [% next_bug = this_bug_idx + 1 %]
-        <a href="show_bug.cgi?id=[% bug_list.$next_bug %]">Next</a>
+        <a href="show_bug.cgi?id=
+                 [%- bug_list.$next_bug FILTER url_quote %]">Next</a>
       [% ELSE %]
         <i><font color="#777777">Next</font></i>
       [% END %]

diff --git a/template/en/default/filterexceptions.pl b/template/en/default/filterexceptions.pl
index 809ca777243716917a5c8b3d93828f337d79215f..4e83aeaad3929471d029afaa017b1ec5df016df8 100644 (file)
--- a/template/en/default/filterexceptions.pl
+++ b/template/en/default/filterexceptions.pl
@@ -250,10 +250,6 @@
 ],
 
 'global/site-navigation.html.tmpl' => [
-  'bug_list.first', 
-  'bug_list.$prev_bug', 
-  'bug_list.$next_bug', 
-  'bug_list.last', 
   'bug.bug_id', 
   'bug.votes', 
 ],
@@ -300,13 +296,6 @@
   '" spellcheck=\"$spellcheck\"" IF spellcheck',
 ],
 
-'bug/navigate.html.tmpl' => [
-  'bug_list.first', 
-  'bug_list.last', 
-  'bug_list.$prev_bug', 
-  'bug_list.$next_bug', 
-],
-
 'bug/show-multiple.html.tmpl' => [
   'attachment.id', 
   'flag.status',

diff --git a/template/en/default/global/site-navigation.html.tmpl b/template/en/default/global/site-navigation.html.tmpl
index 5440fe1f8842c5b2f0b7ea2f73c3aac6258b3627..d8f9cd9869b30e10ffa929dfd82c7b2dc2d558e5 100644 (file)
--- a/template/en/default/global/site-navigation.html.tmpl
+++ b/template/en/default/global/site-navigation.html.tmpl
@@ -36,8 +36,10 @@
   [% IF bug_list && bug_list.size > 0 %]
     <link rel="Up" href="buglist.cgi?regetlastlist=1">
 
-    <link rel="First" href="show_bug.cgi?id=[% bug_list.first %]">
-    <link rel="Last" href="show_bug.cgi?id=[% bug_list.last %]">
+    <link rel="First" href="show_bug.cgi?id=
+                            [%- bug_list.first FILTER url_quote %]">
+    <link rel="Last" href="show_bug.cgi?id=
+                           [%- bug_list.last FILTER url_quote %]">
 
     [% IF bug && bug.bug_id %]
       [% current_bug_idx = lsearch(bug_list, bug.bug_id) %]
@@ -45,12 +47,14 @@
 
         [% IF current_bug_idx > 0 %]
           [% prev_bug = current_bug_idx - 1 %]
-          <link rel="Prev" href="show_bug.cgi?id=[% bug_list.$prev_bug %]">
+          <link rel="Prev" href="show_bug.cgi?id=
+                                 [%- bug_list.$prev_bug FILTER url_quote %]">
         [% END %]
 
         [% IF current_bug_idx + 1 < bug_list.size %]
           [% next_bug = current_bug_idx + 1 %]
-          <link rel="Next" href="show_bug.cgi?id=[% bug_list.$next_bug %]">
+          <link rel="Next" href="show_bug.cgi?id=
+                                 [%- bug_list.$next_bug FILTER url_quote %]">
         [% END %]
 
       [% END %]