From 0bc648d4e13f2f54de9ab08a40b7a75b4179e7c5 Mon Sep 17 00:00:00 2001
From: "lpsolit%gmail.com" <>
Date: Wed, 22 Mar 2006 02:50:13 +0000
Subject: [PATCH] =?utf8?q?Bug=20329783:=20SQL=20crash=20in=20request.cgi?=
 =?utf8?q?=20when=20the=20status=20field=20is=20used=20-=20Patch=20by=20Fr?=
 =?utf8?q?=C3=A9d=C3=A9ric=20Buclin=20<LpSolit@gmail.com>=20r=3Dwurblzap?=
 =?utf8?q?=20a=3Djustdave?=
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

---
 request.cgi | 31 +++++++++++++++++--------------
 1 file changed, 17 insertions(+), 14 deletions(-)

diff --git a/request.cgi b/request.cgi
index 344fb20281..d91846488d 100755
--- a/request.cgi
+++ b/request.cgi
@@ -57,10 +57,10 @@ exit;
 sub queue {
     my $cgi = Bugzilla->cgi;
     my $dbh = Bugzilla->dbh;
-    
-    validateStatus($cgi->param('status'));
-    validateGroup($cgi->param('group'));
-    
+
+    my $status = validateStatus($cgi->param('status'));
+    my $form_group = validateGroup($cgi->param('group'));
+
     my $attach_join_clause = "flags.attach_id = attachments.attach_id";
     if (Param("insidergroup") && !UserInGroup(Param("insidergroup"))) {
         $attach_join_clause .= " AND attachments.isprivate < 1";
@@ -120,7 +120,7 @@ sub queue {
     $query .= " AND flags.is_active = 1 ";
     
     # Limit query to pending requests.
-    $query .= " AND flags.status = '?' " unless $cgi->param('status');
+    $query .= " AND flags.status = '?' " unless $status;
 
     # The set of criteria by which we filter records to display in the queue.
     my @criteria = ();
@@ -134,13 +134,13 @@ sub queue {
     
     # Filter requests by status: "pending", "granted", "denied", "all" 
     # (which means any), or "fulfilled" (which means "granted" or "denied").
-    if ($cgi->param('status')) {
-        if ($cgi->param('status') eq "+-") {
+    if ($status) {
+        if ($status eq "+-") {
             push(@criteria, "flags.status IN ('+', '-')");
             push(@excluded_columns, 'status') unless $cgi->param('do_union');
         }
-        elsif ($cgi->param('status') ne "all") {
-            push(@criteria, "flags.status = '" . $cgi->param('status') . "'");
+        elsif ($status ne "all") {
+            push(@criteria, "flags.status = '$status'");
             push(@excluded_columns, 'status') unless $cgi->param('do_union');
         }
     }
@@ -220,7 +220,6 @@ sub queue {
     # so the loop in the display template can break them up into separate
     # tables every time the value in the group column changes.
 
-    my $form_group = $cgi->param('group');
     $form_group ||= "requestee";
     if ($form_group eq "requester") {
         $query .= " ORDER BY requesters.realname, requesters.login_name";
@@ -294,20 +293,24 @@ sub queue {
 ################################################################################
 
 sub validateStatus {
-    my $status = $_[0];
+    my $status = shift;
     return if !defined $status;
-    
+
     grep($status eq $_, qw(? +- + - all))
       || ThrowCodeError("flag_status_invalid",
                         { status => $status });
+    trick_taint($status);
+    return $status;
 }
 
 sub validateGroup {
-    my $group = $_[0];
+    my $group = shift;
     return if !defined $group;
-    
+
     grep($group eq $_, qw(requester requestee category type))
       || ThrowCodeError("request_queue_group_invalid", 
                         { group => $group });
+    trick_taint($group);
+    return $group;
 }
 
-- 
2.47.2