Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-01-07 11:56:51 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 195530 - Make javascript version of buglists available, part 2. This is a security fix to prevent remote sites being able to see sensitive bug data. Patch by gerv; r=justdave, r=myk, a=justdave.

Browse Source
This commit is contained in:
gerv%gerv.net 2003-11-08 18:04:36 +00:00
parent e3dd841394
commit 21f998a97c
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
webtools/bugzilla/buglist.cgi
View File

@ -88,6 +88,16 @@ if ($::FORM{'format'} && $::FORM{'format'} eq "rdf" && !$::FORM{'ctype'}) {
delete($::FORM{'format'}); delete($::FORM{'format'});
} }
# The js ctype presents a security risk; a malicious site could use it
# to gather information about secure bugs. So, we only allow public bugs to be
# retrieved with this format.
#
# Note that if and when this call clears cookies or has other persistent
# effects, we'll need to do this another way instead.
if ($::FORM{'ctype'} eq "js") {
Bugzilla->logout();
}
# Determine the format in which the user would like to receive the output. # Determine the format in which the user would like to receive the output.
# Uses the default format if the user did not specify an output format; # Uses the default format if the user did not specify an output format;
# otherwise validates the user's choice against the list of available formats. # otherwise validates the user's choice against the list of available formats.

5
webtools/bugzilla/template/en/default/list/list.js.tmpl
View File

@ -18,6 +18,11 @@
# #
# Contributor(s): Gervase Markham <gerv@gerv.net> # Contributor(s): Gervase Markham <gerv@gerv.net>
#%] #%]
// Note: only publicly-accessible bugs (those not in any group) will be
// listed when using this JavaScript format. This is to prevent malicious
// sites stealing information about secure bugs.
bugs = new Array; bugs = new Array;
[% FOREACH bug = bugs %] [% FOREACH bug = bugs %]