From 5caab2d83315c58ad7c8c716448d2462c6397da4 Mon Sep 17 00:00:00 2001
From: "justdave%bugzilla.org" <>
Date: Mon, 25 Oct 2004 14:20:59 +0000
Subject: [PATCH] [SECURITY] Bug 252638: It is possible to send a carefully
 crafted HTTP POST message to process_bug.cgi which will remove keywords from
 a bug even if you don't have permissions to edit all bug fields (the
 "editbugs" permission).  Such changes are reported in "bug changed" email
 notifications, so they are easily detected and reversed if someone abuses it.
 Patch by Myk Melez <myk@mozilla.org> r=gerv, a=justdave

---
 process_bug.cgi | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/process_bug.cgi b/process_bug.cgi
index 5f5d9ba8fc..40eb0fc8c2 100755
--- a/process_bug.cgi
+++ b/process_bug.cgi
@@ -729,6 +729,9 @@ if ($::FORM{'keywords'}) {
 }
 
 my $keywordaction = $::FORM{'keywordaction'} || "makeexact";
+if (!grep($keywordaction eq $_, qw(add delete makeexact))) {
+    $keywordaction = "makeexact";
+}
 
 if ($::comma eq ""
     && 0 == @keywordlist && $keywordaction ne "makeexact"
@@ -860,6 +863,20 @@ foreach my $id (@idlist) {
         }
         $i++;
     }
+
+    # When editing multiple bugs, users can specify a list of keywords to delete
+    # from bugs.  If the list matches the current set of keywords on those bugs,
+    # CheckCanChangeField above will fail to check permissions because it thinks
+    # the list hasn't changed.  To fix that, we have to call CheckCanChangeField
+    # again with old!=new if the keyword action is "delete" and old=new.
+    if ($keywordaction eq "delete"
+        && exists $::FORM{keywords}
+        && length(@keywordlist) > 0
+        && $::FORM{keywords} eq $oldhash{keywords})
+    {
+        CheckCanChangeField("keywords", $id, $oldhash{keywords}, "");
+    }
+
     if ($requiremilestone) {
         my $value = $::FORM{'target_milestone'};
         if (!defined $value || $value eq $::dontchange) {
@@ -983,7 +1000,7 @@ foreach my $id (@idlist) {
         }
     }
 
-    if (@::legal_keywords) {
+    if (@::legal_keywords && exists $::FORM{keywords}) {
         # There are three kinds of "keywordsaction": makeexact, add, delete.
         # For makeexact, we delete everything, and then add our things.
         # For add, we delete things we're adding (to make sure we don't
-- 
2.47.2