Bug 802204 (CVE-2012-4197): [SECURITY] Marking an attachment you cannot see as obsole...

r=gerv a=LpSolit

diff --git a/Bugzilla/Attachment.pm b/Bugzilla/Attachment.pm
index 8f296d263daabbdb401ecf028fb7a229d04be5b4..e7e707b985c0b58a5573f6f8d85f6301f8ee267c 100644 (file)
--- a/Bugzilla/Attachment.pm
+++ b/Bugzilla/Attachment.pm
@@ -765,11 +765,8 @@ sub validate_obsolete {
         $attachment->validate_can_edit($bug->product_id)
           || ThrowUserError('illegal_attachment_edit', { attach_id => $attachment->id });
 
-        $vars->{'description'} = $attachment->description;
-
         if ($attachment->bug_id != $bug->bug_id) {
             $vars->{'my_bug_id'} = $bug->bug_id;
-            $vars->{'attach_bug_id'} = $attachment->bug_id;
             ThrowUserError('mismatched_bug_ids_on_obsolete', $vars);
         }