diff options
| author |   Frédéric Buclin <LpSolit@gmail.com> | 2012-11-13 18:25:25 +0100 |
|---|---|---|
| committer | Frédéric Buclin <LpSolit@gmail.com> | 2012-11-13 18:25:25 +0100 |
| commit | 9a99b3450a807c16094494f93adf0e97afa09c18 (patch) | |
| tree | 1330c7ed28929f712d43c380e478496418e9c72d | |
| parent | Bug 731178 (CVE-2012-4199): [SECURITY] field-events.js.tmpl discloses product... (diff) | |
| download | bugzilla-9a99b3450a807c16094494f93adf0e97afa09c18.tar.gz bugzilla-9a99b3450a807c16094494f93adf0e97afa09c18.tar.bz2 bugzilla-9a99b3450a807c16094494f93adf0e97afa09c18.zip | |
Bug 802204 (CVE-2012-4197): [SECURITY] Marking an attachment you cannot see as obsolete can disclose its description
r=gerv a=LpSolit
| -rw-r--r-- | Bugzilla/Attachment.pm | 3 | ||||
| -rw-r--r-- | template/en/default/global/code-error.html.tmpl | 3 |
2 files changed, 1 insertions, 5 deletions
diff --git a/Bugzilla/Attachment.pm b/Bugzilla/Attachment.pm index d6037b3e7..fb3725aff 100644 --- a/Bugzilla/Attachment.pm +++ b/Bugzilla/Attachment.pm @@ -771,11 +771,8 @@ sub validate_obsolete { $attachment->validate_can_edit($bug->product_id) || ThrowUserError('illegal_attachment_edit', { attach_id => $attachment->id }); - $vars->{'description'} = $attachment->description; - if ($attachment->bug_id != $bug->bug_id) { $vars->{'my_bug_id'} = $bug->bug_id; - $vars->{'attach_bug_id'} = $attachment->bug_id; ThrowCodeError('mismatched_bug_ids_on_obsolete', $vars); } diff --git a/template/en/default/global/code-error.html.tmpl b/template/en/default/global/code-error.html.tmpl index 3db03fca4..bee2da1a7 100644 --- a/template/en/default/global/code-error.html.tmpl +++ b/template/en/default/global/code-error.html.tmpl @@ -256,8 +256,7 @@ setting in [% constants.bz_locations.localconfig FILTER html %]. [% ELSIF error == "mismatched_bug_ids_on_obsolete" %] - Attachment [% attach_id FILTER html %] ([% description FILTER html %]) - is attached to [% terms.bug %] [%+ attach_bug_id FILTER html %], + Attachment [% attach_id FILTER html %] is attached to another [% terms.bug %], but you tried to flag it as obsolete while creating a new attachment to [% terms.bug %] [%+ my_bug_id FILTER html %]. |