Bug 213384: shutdownhtml login bypass via editparams.cgi is broken under suexec....

diff --git a/CGI.pl b/CGI.pl
index 75174dcba1c8b21796fb6f4c61620d564706daeb..bcd9a7f90042bffda9d27dbbb8ee72ac152a9be6 100644 (file)
--- a/CGI.pl
+++ b/CGI.pl
@@ -55,7 +55,7 @@ use vars qw($template $vars);
 # to the user about the downtime.  (do)editparams.cgi is exempted from
 # this message, of course, since it needs to be available in order for
 # the administrator to open Bugzilla back up.
-if (Param("shutdownhtml") && $0 !~ m:[\\/](do)?editparams.cgi$:) {
+if (Param("shutdownhtml") && $0 !~ m:(^|[\\/])(do)?editparams\.cgi$:) {
     $::vars->{'message'} = "shutdown";
     
     # Return the appropriate HTTP response headers.