Bug 335354: editparams.cgi crashes when editing the 'languages' and 'defaultlanguage...

diff --git a/Bugzilla/Config/Common.pm b/Bugzilla/Config/Common.pm
index 0d6db5257e47219d2fd8ad458b8b70cefa9b2f8a..c309059d29ebc5024fe91d2fcea00ef98b549b52 100644 (file)
--- a/Bugzilla/Config/Common.pm
+++ b/Bugzilla/Config/Common.pm
@@ -285,17 +285,26 @@ sub check_image_converter {
 }
 
 sub check_languages {
-    my @languages = split /[,\s]+/, trim($_[0]);
+    my ($lang, $param) = @_;
+    my @languages = split(/[,\s]+/, trim($lang));
     if(!scalar(@languages)) {
        return "You need to specify a language tag."
     }
+    if (scalar(@languages) > 1 && $param && $param->{'name'} eq 'defaultlanguage') {
+        return "You can only specify one language tag";
+    }
     my $templatedir = bz_locations()->{'templatedir'};
+    my %lang_seen;
+    my @validated_languages;
     foreach my $language (@languages) {
        if(   ! -d "$templatedir/$language/custom" 
           && ! -d "$templatedir/$language/default") {
           return "The template directory for $language does not exist";
        }
+       push(@validated_languages, $language) unless $lang_seen{$language}++;
     }
+    # Rebuild the list of language tags, avoiding duplicates.
+    $_[0] = join(', ', @validated_languages);
     return "";
 }
 

diff --git a/editparams.cgi b/editparams.cgi
index ca74df6853295de8eb2ccfb8a86537b6c5e6964c..b4100a0b1d0e417550f3121814fede8db617a07c 100755 (executable)
--- a/editparams.cgi
+++ b/editparams.cgi
@@ -145,7 +145,9 @@ if ($action eq 'save' && $current_module) {
         # then we delete it (the user pref is reset to the default one).
         my @languages = split(/[\s,]+/, Bugzilla->params->{'languages'});
         map {trick_taint($_)} @languages;
-        add_setting('lang', \@languages, Bugzilla->params->{'defaultlanguage'}, undef, 1);
+        my $lang = Bugzilla->params->{'defaultlanguage'};
+        trick_taint($lang);
+        add_setting('lang', \@languages, $lang, undef, 1);
     }
 
     $vars->{'message'} = 'parameters_updated';