Bug 790296 (CVE-2012-4189): [SECURITY] Field values are not escaped correctly in...

r=dkl a=LpSolit

diff --git a/report.cgi b/report.cgi
index de587f1435b8b13b8938076d785dd6b84856776b..e70dcf4b2cfaf004dcca0f6064b08a3a7d940724 100755 (executable)
--- a/report.cgi
+++ b/report.cgi
@@ -387,5 +387,5 @@ sub get_field_restrictions {
     my $field = shift;
     my $cgi = Bugzilla->cgi;
 
-    return join('&', map {"$field=$_"} $cgi->param($field));
+    return join('&', map {url_quote($field) . '=' . url_quote($_)} $cgi->param($field));
 }

diff --git a/template/en/default/reports/report-table.html.tmpl b/template/en/default/reports/report-table.html.tmpl
index 0e6193c25965c66494cdd2209a5cd78eb7936a59..466a87d9ff3f48d8d16ea7d644d40c9050b6fa55 100644 (file)
--- a/template/en/default/reports/report-table.html.tmpl
+++ b/template/en/default/reports/report-table.html.tmpl
@@ -85,7 +85,7 @@ YAHOO.util.Event.addListener(window, "load", function() {
   var myColumnDefs = [
         {key:"row_title", label:"", sortable:true, sortOptions: { sortFunction:totalNumberSorter }},
         [% FOREACH col = col_names %]
-          {key:"[% col FILTER js %]", label:"[% display_value(col_field, col) FILTER js %]", sortable:true,
+          {key:"[% col FILTER js %]", label:"[% display_value(col_field, col) FILTER html FILTER js %]", sortable:true,
            formatter:this.Linkify, sortOptions: { defaultDir: YAHOO.widget.DataTable.CLASS_DESC, sortFunction:totalNumberSorter }},
         [% END %]
         {key:"total", label:"Total", sortable:true, formatter:this.LinkifyTotal,