From: bugreport%peshkin.net <>
Date: Sat, 10 Jul 2004 14:27:48 +0000 (+0000)
Subject: Bug 236650: html_quote and validate email addresses in editueser.cgi
X-Git-Tag: bugzilla-2.18rc1~11
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1ade641d4492138b0590c5717b47b429fff83d8a;p=thirdparty%2Fbugzilla.git

Bug 236650: html_quote and validate email addresses in editueser.cgi
patch by vlad
r=joel,justdave
a=justdave
---

diff --git a/editusers.cgi b/editusers.cgi
index f7824e4359..9dfc672d9b 100755
--- a/editusers.cgi
+++ b/editusers.cgi
@@ -357,7 +357,7 @@ if ($action eq 'list') {
         }
         $realname = ($realname ? html_quote($realname) : "<FONT COLOR=\"red\">missing</FONT>");
         print "<TR>\n";
-        print "  <TD VALIGN=\"top\"><A HREF=\"editusers.cgi?action=edit&user=", url_quote($user), "\"><B>$s$user$e</B></A></TD>\n";
+        print "  <TD VALIGN=\"top\"><A HREF=\"editusers.cgi?action=edit&user=", url_quote($user), "\"><B>$s", html_quote($user), "$e</B></A></TD>\n";
         print "  <TD VALIGN=\"top\">$s$realname$e</TD>\n";
         if ($candelete) {
             print "  <TD VALIGN=\"top\"><A HREF=\"editusers.cgi?action=del&user=", url_quote($user), "\">Delete</A></TD>\n";
@@ -749,6 +749,14 @@ if ($action eq 'update') {
              WHERE login_name=" . SqlQuote($userold));
     my ($thisuserid) = FetchSQLData();
 
+    my $emailregexp = Param("emailregexp");
+    unless ($user =~ m/$emailregexp/) {
+        print "The user name entered must be a valid e-mail address. Please press\n";
+        print "<b>Back</b> and try again.\n";
+        PutTrailer($localtrailer);
+        exit;
+    }
+
     my @grpadd = ();
     my @grpdel = ();
     my $chggrp = 0;