diff options
| author |   Frédéric Buclin <LpSolit@gmail.com> | 2012-11-13 18:55:31 +0100 |
|---|---|---|
| committer | Frédéric Buclin <LpSolit@gmail.com> | 2012-11-13 18:55:31 +0100 |
| commit | 5d80ee9fbb955a77899325b56f1a574e2ff8c410 (patch) | |
| tree | 198c8d153df0f290f9dc9d9991286c882cb4510c | |
| parent | Bug 808845 (CVE-2012-5475): [SECURITY] Security vulnerability in YUI's swfsto... (diff) | |
| download | bugzilla-5d80ee9fbb955a77899325b56f1a574e2ff8c410.tar.gz bugzilla-5d80ee9fbb955a77899325b56f1a574e2ff8c410.tar.bz2 bugzilla-5d80ee9fbb955a77899325b56f1a574e2ff8c410.zip | |
Bug 790296 (CVE-2012-4189): [SECURITY] Field values are not escaped correctly in tabular reports
r=dkl a=LpSolit
| -rwxr-xr-x | report.cgi | 2 | ||||
| -rw-r--r-- | template/en/default/reports/report-table.html.tmpl | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/report.cgi b/report.cgi index 9c228be52..4e06c1169 100755 --- a/report.cgi +++ b/report.cgi @@ -386,5 +386,5 @@ sub get_field_restrictions { my $field = shift; my $cgi = Bugzilla->cgi; - return join('&', map {"$field=$_"} $cgi->param($field)); + return join('&', map {url_quote($field) . '=' . url_quote($_)} $cgi->param($field)); } diff --git a/template/en/default/reports/report-table.html.tmpl b/template/en/default/reports/report-table.html.tmpl index 0e6193c25..466a87d9f 100644 --- a/template/en/default/reports/report-table.html.tmpl +++ b/template/en/default/reports/report-table.html.tmpl @@ -85,7 +85,7 @@ YAHOO.util.Event.addListener(window, "load", function() { var myColumnDefs = [ {key:"row_title", label:"", sortable:true, sortOptions: { sortFunction:totalNumberSorter }}, [% FOREACH col = col_names %] - {key:"[% col FILTER js %]", label:"[% display_value(col_field, col) FILTER js %]", sortable:true, + {key:"[% col FILTER js %]", label:"[% display_value(col_field, col) FILTER html FILTER js %]", sortable:true, formatter:this.Linkify, sortOptions: { defaultDir: YAHOO.widget.DataTable.CLASS_DESC, sortFunction:totalNumberSorter }}, [% END %] {key:"total", label:"Total", sortable:true, formatter:this.LinkifyTotal, |