From f8aa20925c5b7cc83fa1936a23ed970efba80984 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Fr=C3=A9d=C3=A9ric=20Buclin?= <LpSolit@gmail.com>
Date: Tue, 19 Feb 2013 18:27:50 +0100
Subject: [PATCH] Bug 842038: (CVE-2013-0785) [SECURITY] XSS in show_bug.cgi
 when using an invalid page format r=glob a=LpSolit

---
 Bugzilla/Template.pm |  1 +
 show_bug.cgi         | 11 +++++------
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/Bugzilla/Template.pm b/Bugzilla/Template.pm
index 663d85957d..cd7507963d 100644
--- a/Bugzilla/Template.pm
+++ b/Bugzilla/Template.pm
@@ -140,6 +140,7 @@ sub get_format {
     return
     {
         'template'    => $template,
+        'format'      => $format,
         'extension'   => $ctype,
         'ctype'       => Bugzilla::Constants::contenttypes->{$ctype}
     };
diff --git a/show_bug.cgi b/show_bug.cgi
index 7ea55e7320..a2bf57ada0 100755
--- a/show_bug.cgi
+++ b/show_bug.cgi
@@ -37,9 +37,11 @@ my $vars = {};
 
 my $user = Bugzilla->login();
 
+my $format = $template->get_format("bug/show", scalar $cgi->param('format'),
+                                   scalar $cgi->param('ctype'));
+
 # Editable, 'single' HTML bugs are treated slightly specially in a few places
-my $single = !$cgi->param('format')
-  && (!$cgi->param('ctype') || $cgi->param('ctype') eq 'html');
+my $single = !$format->{format} && $format->{extension} eq 'html';
 
 # If we don't have an ID, _AND_ we're only doing a single bug, then prompt
 if (!$cgi->param('id') && $single) {
@@ -49,9 +51,6 @@ if (!$cgi->param('id') && $single) {
     exit;
 }
 
-my $format = $template->get_format("bug/show", scalar $cgi->param('format'), 
-                                   scalar $cgi->param('ctype'));
-
 my @bugs;
 my %marks;
 
@@ -127,5 +126,5 @@ $vars->{'displayfields'} = \%displayfields;
 
 print $cgi->header($format->{'ctype'});
 
-$template->process("$format->{'template'}", $vars)
+$template->process($format->{'template'}, $vars)
   || ThrowTemplateError($template->error());
-- 
2.47.2