Bug 319082: "new Bugzilla::User($uid)" allows you to pass invalid $uid - Patch by...

diff --git a/Bugzilla/User.pm b/Bugzilla/User.pm
index 681bd5f5fa9c9eac337cdcfaa8b6460eefa8f5c5..85af4fd4dfa2d0d428b8fbbdc420cf5d593901af 100644 (file)
--- a/Bugzilla/User.pm
+++ b/Bugzilla/User.pm
@@ -66,10 +66,20 @@ use constant MATCH_SKIP_CONFIRM  => 1;
 
 sub new {
     my $invocant = shift;
-    if (scalar @_ == 0) {
+    my $user_id = shift;
+
+    if ($user_id) {
+        my $uid = $user_id;
+        detaint_natural($user_id)
+          || ThrowCodeError('invalid_numeric_argument',
+                            {argument => 'userID',
+                             value    => $uid,
+                             function => 'Bugzilla::User::new'});
+        return $invocant->_create("userid=?", $user_id);
+    }
+    else {
         return $invocant->_create;
     }
-    return $invocant->_create("userid=?", @_);
 }
 
 # This routine is sort of evil. Nothing except the login stuff should
@@ -82,8 +92,10 @@ sub new {
 # in the id its already had to validate (or the User.pm object, of course)
 sub new_from_login {
     my $invocant = shift;
+    my $login = shift;
+
     my $dbh = Bugzilla->dbh;
-    return $invocant->_create($dbh->sql_istrcmp('login_name', '?'), @_);
+    return $invocant->_create($dbh->sql_istrcmp('login_name', '?'), $login);
 }
 
 # Internal helper for the above |new| methods