From: jocuri%softhome.net <>
Date: Wed, 8 Oct 2003 02:15:35 +0000 (+0000)
Subject: Bug 213384: shutdownhtml login bypass via editparams.cgi is broken under suexec.... 
X-Git-Tag: bugzilla-2.17.5~46
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6df993a22dd55cb29aad9b0c173b5dd0f54e42c7;p=thirdparty%2Fbugzilla.git

Bug 213384: shutdownhtml login bypass via editparams.cgi is broken under suexec. r=kiko, a=justdave
---

diff --git a/CGI.pl b/CGI.pl
index 75174dcba1..bcd9a7f900 100644
--- a/CGI.pl
+++ b/CGI.pl
@@ -55,7 +55,7 @@ use vars qw($template $vars);
 # to the user about the downtime.  (do)editparams.cgi is exempted from
 # this message, of course, since it needs to be available in order for
 # the administrator to open Bugzilla back up.
-if (Param("shutdownhtml") && $0 !~ m:[\\/](do)?editparams.cgi$:) {
+if (Param("shutdownhtml") && $0 !~ m:(^|[\\/])(do)?editparams\.cgi$:) {
     $::vars->{'message'} = "shutdown";
     
     # Return the appropriate HTTP response headers.