Fix for bug 95535: the token generator for password resets is allowing the & characte...

Patch by Dave Miller <justdave@syndicomm.com>
r= myk@mozilla.org

diff --git a/Bugzilla/Token.pm b/Bugzilla/Token.pm
index cde97f87e97361735c6324ddfd3c80e0a9d1e32c..2d5dad2a3331fb282b149ac3d16facdbe6d0372d 100644 (file)
--- a/Bugzilla/Token.pm
+++ b/Bugzilla/Token.pm
@@ -100,6 +100,7 @@ sub MailPasswordToken {
 
     my $urlbase = &::Param("urlbase");
     my $emailsuffix = &::Param('emailsuffix');
+    $token = &::url_quote($token);
 
     open SENDMAIL, "|/usr/lib/sendmail -t";
 

diff --git a/Token.pm b/Token.pm
index cde97f87e97361735c6324ddfd3c80e0a9d1e32c..2d5dad2a3331fb282b149ac3d16facdbe6d0372d 100644 (file)
--- a/Token.pm
+++ b/Token.pm
@@ -100,6 +100,7 @@ sub MailPasswordToken {
 
     my $urlbase = &::Param("urlbase");
     my $emailsuffix = &::Param('emailsuffix');
+    $token = &::url_quote($token);
 
     open SENDMAIL, "|/usr/lib/sendmail -t";