From: Frédéric Buclin <LpSolit@gmail.com>
Date: Wed, 12 Sep 2012 23:44:01 +0000 (+0200)
Subject: Bug 783794: Bugzilla::User->visible_bugs should validate input data
X-Git-Tag: bugzilla-4.5.1~394
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4d1a1df823cd3690ff14b2579291182d6dbf7934;p=thirdparty%2Fbugzilla.git

Bug 783794: Bugzilla::User->visible_bugs should validate input data
r=glob a=LpSolit
---

diff --git a/Bugzilla/User.pm b/Bugzilla/User.pm
index 87255b20a0..9fa7458e71 100644
--- a/Bugzilla/User.pm
+++ b/Bugzilla/User.pm
@@ -883,6 +883,14 @@ sub visible_bugs {
     if (@check_ids) {
         my $dbh = Bugzilla->dbh;
         my $user_id = $self->id;
+
+        foreach my $id (@check_ids) {
+            my $orig_id = $id;
+            detaint_natural($id)
+              || ThrowCodeError('param_must_be_numeric', { param    => $orig_id,
+                                                           function => 'Bugzilla::User->visible_bugs'});
+        }
+
         my $sth;
         # Speed up the can_see_bug case.
         if (scalar(@check_ids) == 1) {