]> git.ipfire.org Git - thirdparty/bugzilla.git/commit
projects / thirdparty / bugzilla.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: e8f1d94) | patch
[SECURITY] Bug 252638: It is possible to send a carefully crafted HTTP POST message...
authorjustdave%bugzilla.org <>
Mon, 25 Oct 2004 14:19:55 +0000 (14:19 +0000)
committerjustdave%bugzilla.org <>
Mon, 25 Oct 2004 14:19:55 +0000 (14:19 +0000)
commita839c5d62cae06a3e038bcd8d0e2b65862f49090
treee2f4d375e5641cae49b6e7522830b06ba608edc8tree | snapshot
parente8f1d94a04305a39eb0f78b9c58fe28d63898209commit | diff
[SECURITY] Bug 252638: It is possible to send a carefully crafted HTTP POST message to process_bug.cgi which will remove keywords from a bug even if you don't have permissions to edit all bug fields (the "editbugs" permission).  Such changes are reported in "bug changed" email notifications, so they are easily detected and reversed if someone abuses it.
Patch by Myk Melez <myk@mozilla.org>
r=gerv, a=justdave
process_bug.cgi diff | blob | blame | history
Mirror of https://github.com/bugzilla/bugzilla.git