Skip to content

bugzilla
bugzilla
Commit 6f66681a authored by myk%mozilla.org's avatar myk%mozilla.org
Browse files
Options

Fix for bug 108821: Prevent users with any blessgroupset privileges from blessing any group set.

Patch by Jake <jake@acutex.net> and Bradley <bbaetz@cs.mcgill.ca>. r=jake,myk for Bradley's portion, r=bbaetz,myk for Jake's portion.
parent 4b5278c7
Show whitespace changes
Inline Side-by-side
Showing with 4 additions and 1 deletion
editusers.cgi
View file @ 6f66681a
...@@ -742,12 +742,14 @@ if ($action eq 'update') { ...@@ -742,12 +742,14 @@ if ($action eq 'update') {
foreach (keys %::FORM) { foreach (keys %::FORM) {
next unless /^bit_/; next unless /^bit_/;
#print "$_=$::FORM{$_}<br>\n"; #print "$_=$::FORM{$_}<br>\n";
detaint_natural($::FORM{$_}) || die "Groupset field tampered with";
$groupset .= " + $::FORM{$_}"; $groupset .= " + $::FORM{$_}";
} }
my $blessgroupset = "0"; my $blessgroupset = "0";
foreach (keys %::FORM) { foreach (keys %::FORM) {
next unless /^blbit_/; next unless /^blbit_/;
#print "$_=$::FORM{$_}<br>\n"; #print "$_=$::FORM{$_}<br>\n";
detaint_natural($::FORM{$_}) || die "Blessgroupset field tampered with";
$blessgroupset .= " + $::FORM{$_}"; $blessgroupset .= " + $::FORM{$_}";
} }
...@@ -767,7 +769,8 @@ if ($action eq 'update') { ...@@ -767,7 +769,8 @@ if ($action eq 'update') {
} else { } else {
SendSQL("UPDATE profiles SendSQL("UPDATE profiles
SET groupset = SET groupset =
groupset - (groupset & $opblessgroupset) + $groupset groupset - (groupset & $opblessgroupset) +
(($groupset) & $opblessgroupset)
WHERE login_name=" . SqlQuote($userold)); WHERE login_name=" . SqlQuote($userold));
# I'm paranoid that someone who I give the ability to bless people # I'm paranoid that someone who I give the ability to bless people
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment