Bug 242405 Turning on QA contact causes taint error in Bugzilla/Series.pm when adding...

patch by bugzilla@glob.com.au r=joel a=justdave

diff --git a/Bugzilla/Series.pm b/Bugzilla/Series.pm
index f009a0ad9801c3c7a1382c85e382de7e2037ef5e..4d01a71ca59eeb97ff3251adbed5c7371c8ff2b5 100644 (file)
--- a/Bugzilla/Series.pm
+++ b/Bugzilla/Series.pm
@@ -180,7 +180,6 @@ sub writeToDatabase {
     }
     else {
         # Insert the new series into the series table
-        trick_taint($self->{'query'});
         $dbh->do("INSERT INTO series (creator, category, subcategory, " .
                  "name, frequency, query) VALUES ($self->{'creator'}, " .
                  "$category_id, $subcategory_id, " .

diff --git a/editcomponents.cgi b/editcomponents.cgi
index 4c00050fa1bcfe69508b44eea0ac6057e70a2066..00c06912f3a7ba53a28f1069ee701b2e4d7c7337 100755 (executable)
--- a/editcomponents.cgi
+++ b/editcomponents.cgi
@@ -46,7 +46,7 @@ sub sillyness {
 
 my $dobugcounts = (defined $::FORM{'dobugcounts'});
 
-
+my $cgi = Bugzilla->cgi;
 
 # TestProduct:    just returns if the specified product does exists
 # CheckProduct:   same check, optionally  emit an error text
@@ -458,12 +458,21 @@ if ($action eq 'new') {
 
     # For localisation reasons, we get the title of the queries from the
     # submitted form.
+    my $open_name = $cgi->param('open_name');
+    my $closed_name = $cgi->param('closed_name');
     my @openedstatuses = ("UNCONFIRMED", "NEW", "ASSIGNED", "REOPENED");
-    my $statuses = join("&", map { "bug_status=$_" } @openedstatuses);
-    push(@series, [$::FORM{'open_name'}, $statuses . $prodcomp]);
-
-    my $resolved = "field0-0-0=resolution&type0-0-0=notequals&value0-0-0=---";
-    push(@series, [$::FORM{'closed_name'}, $resolved . $prodcomp]);
+    my $statuses = join("&", map { "bug_status=$_" } @openedstatuses) . $prodcomp;
+    my $resolved = "field0-0-0=resolution&type0-0-0=notequals&value0-0-0=---" . $prodcomp;
+
+    # trick_taint is ok here, as these variables aren't used as a command
+    # or in SQL unquoted
+    trick_taint($open_name);
+    trick_taint($closed_name);
+    trick_taint($statuses);
+    trick_taint($resolved);
+
+    push(@series, [$open_name, $statuses]);
+    push(@series, [$closed_name, $resolved]);
 
     foreach my $sdata (@series) {
         my $series = new Bugzilla::Series(undef, $product, $component,