Bug 165221: Apostrophes not properly handled during account creation. r=joel,r2=bbaetz

diff --git a/createaccount.cgi b/createaccount.cgi
index 79be1bb64fa445448589313fd91c7d91ff682fe5..13256f47b70c09241722f6bc11ed2c78823cd045 100755 (executable)
--- a/createaccount.cgi
+++ b/createaccount.cgi
@@ -65,7 +65,6 @@ if (defined($login)) {
     # We've been asked to create an account.
     my $realname = trim($::FORM{'realname'});
     CheckEmailSyntax($login);
-    trick_taint($login);
     $vars->{'login'} = $login;
     
     if (!ValidateNewUser($login)) {

diff --git a/globals.pl b/globals.pl
index 21bdc46cf5d10492c597c19dca8d4f703588682d..624f31171b149aeaf215d3e5263859cce6295416 100644 (file)
--- a/globals.pl
+++ b/globals.pl
@@ -552,11 +552,19 @@ sub ValidateNewUser {
         return 0;
     }
 
+    my $sqluname = SqlQuote($username);
+
     # Reject if the new login is part of an email change which is 
     # still in progress
+    #
+    # substring/locate stuff: bug 165221; this used to use regexes, but that
+    # was unsafe and required weird escaping; using substring to pull out
+    # the new/old email addresses and locate() to find the delimeter (':')
+    # is cleaner/safer
     SendSQL("SELECT eventdata FROM tokens WHERE tokentype = 'emailold' 
-                AND eventdata like '%:$username' 
-                 OR eventdata like '$username:%'");
+     AND SUBSTRING(eventdata, 1, (LOCATE(':', eventdata) - 1)) = $sqluname 
+     OR SUBSTRING(eventdata, (LOCATE(':', eventdata) + 1)) = $sqluname");
+
     if (my ($eventdata) = FetchSQLData()) {
         # Allow thru owner of token
         if($old_username && ($eventdata eq "$old_username:$username")) {