From: lpsolit%gmail.com <>
Date: Mon, 10 Aug 2009 20:22:38 +0000 (+0000)
Subject: Bug 503980: show_bug.cgi doesn't properly escape <!-- inside bug summary - Patch... 
X-Git-Tag: bugzilla-3.4.2~26
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d9ba7fa16e8b0c7135408f52056783d0cb92e5c0;p=thirdparty%2Fbugzilla.git

Bug 503980: show_bug.cgi doesn't properly escape <!-- inside bug summary - Patch by Frédéric Buclin <LpSolit@gmail.com> r=mkanat a=LpSolit
---

diff --git a/Bugzilla/Template.pm b/Bugzilla/Template.pm
index c8ce711b83..89d94c0245 100644
--- a/Bugzilla/Template.pm
+++ b/Bugzilla/Template.pm
@@ -514,6 +514,7 @@ sub create {
                 $var =~ s/\n/\\n/g;
                 $var =~ s/\r/\\r/g;
                 $var =~ s/\@/\\x40/g; # anti-spam for email addresses
+                $var =~ s/</\\x3c/g;
                 return $var;
             },