Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-01-05 15:59:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 287436: [SECURITY] After having logged in, links to change the report type contain username and password

Browse Source 
Patch By Marc Schumann <wurblzap@gmail.com> r=gerv, a=justdave
This commit is contained in:
mkanat%kerio.com 2005-05-12 01:52:13 +00:00
parent 02b491c5e1
commit 46e7119951
3 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
webtools/bugzilla/Bugzilla/Auth/Login/WWW/CGI.pm
View File

@ -50,6 +50,8 @@ sub login {
# First, try the actual login method against form variables
my $username = $cgi->param("Bugzilla_login");
my $passwd = $cgi->param("Bugzilla_password");
$cgi->delete('Bugzilla_login', 'Bugzilla_password');
my $authmethod = Param("user_verify_class");
my ($authres, $userid, $extra, $info) =

3
webtools/bugzilla/chart.cgi
View File

@ -286,8 +286,7 @@ sub wrap {
$vars->{'time'} = time();
$vars->{'imagebase'} = $cgi->canonicalise_query(
"action", "action-wrap", "ctype", "format", "width", "height",
"Bugzilla_login", "Bugzilla_password");
"action", "action-wrap", "ctype", "format", "width", "height");
print $cgi->header();
$template->process("reports/chart.html.tmpl", $vars)

11
webtools/bugzilla/userprefs.cgi
View File

@ -388,12 +388,19 @@ sub SaveSavedSearches() {
# Live code (not subroutine definitions) starts here
###############################################################################
my $cgi = Bugzilla->cgi;
# This script needs direct access to the username and password CGI variables,
# so we save them before their removal in Bugzilla->login
my $bugzilla_login = $cgi->param('Bugzilla_login');
my $bugzilla_password = $cgi->param('Bugzilla_password');
Bugzilla->login(LOGIN_REQUIRED);
$cgi->param('Bugzilla_login', $bugzilla_login);
$cgi->param('Bugzilla_password', $bugzilla_password);
GetVersionTable();
my $cgi = Bugzilla->cgi;
$vars->{'changes_saved'} = $cgi->param('dosave');
my $current_tab_name = $cgi->param('tab') || "account";