From: lpsolit%gmail.com <>
Date: Mon, 10 Aug 2009 20:20:25 +0000 (+0000)
Subject: Bug 503980: show_bug.cgi doesn't properly escape <!-- inside bug summary - Patch... 
X-Git-Tag: bugzilla-3.5.1~118
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=918a8c245f8d0d7d0926a015aa9a4940c14ebdd3;p=thirdparty%2Fbugzilla.git

Bug 503980: show_bug.cgi doesn't properly escape <!-- inside bug summary - Patch by Frédéric Buclin <LpSolit@gmail.com> r=mkanat a=LpSolit
---

diff --git a/Bugzilla/Template.pm b/Bugzilla/Template.pm
index f90e472b55..49954a5215 100644
--- a/Bugzilla/Template.pm
+++ b/Bugzilla/Template.pm
@@ -520,6 +520,7 @@ sub create {
                 $var =~ s/\n/\\n/g;
                 $var =~ s/\r/\\r/g;
                 $var =~ s/\@/\\x40/g; # anti-spam for email addresses
+                $var =~ s/</\\x3c/g;
                 return $var;
             },