Bug 653477: (CVE-2011-2380) [SECURITY] Group names can be guessed when creating or...

r=dkl a=LpSolit

diff --git a/Bugzilla/Bug.pm b/Bugzilla/Bug.pm
index 3cd5a38224bed7c3262723274a9b207858b68954..a9b52f45c8ce06734fa61c542c3a509f1d163591 100644 (file)
--- a/Bugzilla/Bug.pm
+++ b/Bugzilla/Bug.pm
@@ -1403,7 +1403,7 @@ sub _check_groups {
             || ThrowUserError("invalid_group_ID");
 
         # This can only happen if somebody hacked the enter_bug form.
-        ThrowCodeError("inactive_group", { name => $group->name })
+        ThrowCodeError("inactive_group", { group_id => $id })
             unless $group->is_active;
 
         my $membercontrol = $controls->{$id}

diff --git a/template/en/default/global/code-error.html.tmpl b/template/en/default/global/code-error.html.tmpl
index b09f71a350d36842c469e09c4dae3f74d104e290..e70f5b2a6771f3ef93af074fe013a678f5fa3018 100644 (file)
--- a/template/en/default/global/code-error.html.tmpl
+++ b/template/en/default/global/code-error.html.tmpl
@@ -217,8 +217,8 @@
     A legal [% field FILTER html %] was not set.
 
   [% ELSIF error == "inactive_group" %]
-    Attempted to add [% terms.bug %] to the '[% name FILTER html %]'
-    group, which is not used for [% terms.bugs %].
+    Attempted to add [% terms.abug %] to group ID [% group_id FILTER html %],
+    which is not used for [% terms.bugs %].
 
   [% ELSIF error == "invalid_attach_id_to_obsolete" %]
      The attachment number of one of the attachments you wanted to obsolete,