Fix for bug 252159: centralize time validation. Adds a ValidateTime

Bugzilla/Bug.pm

@@ -42,6 +42,7 @@ use Bugzilla::Flag;
 use Bugzilla::FlagType;
 use Bugzilla::User;
 use Bugzilla::Util;
+use Bugzilla::Error;
 
 sub fields {
     # Keep this ordering in sync with bugzilla.dtd
@@ -489,6 +490,13 @@ sub EmitDependList {
   return @list;
 }
 
+sub ValidateTime{
+  my ($time, $field) = @_;
+    if ($time > 99999.99 || $time < 0 || !($time =~ /^(?:\d+(?:\.\d*)?|\.\d+)$/)){
+      ThrowUserError("need_positive_number", {field => "$field"}, 1);
+    }
+ }
+
 sub AUTOLOAD {
   use vars qw($AUTOLOAD);
   my $attr = $AUTOLOAD;

post_bug.cgi

@@ -342,12 +342,8 @@ if (UserInGroup(Param("timetrackinggroup")) &&
     defined $::FORM{'estimated_time'}) {
 
     my $est_time = $::FORM{'estimated_time'};
-    if ($est_time =~ /^(?:\d+(?:\.\d*)?|\.\d+)$/) {
-        $sql .= SqlQuote($est_time) . "," . SqlQuote($est_time);
-    } else {
-        ThrowUserError("need_positive_number",
-                       { field => 'estimated_time' });
-    }
+    Bugzilla::Bug::ValidateTime($est_time, 'estimated_time');
+    $sql .= SqlQuote($est_time) . "," . SqlQuote($est_time);
 } else {
     $sql .= "0, 0";
 }

process_bug.cgi

@@ -766,16 +766,9 @@ if (UserInGroup(Param('timetrackinggroup'))) {
         if (defined $::FORM{$field}) {
             my $er_time = trim($::FORM{$field});
             if ($er_time ne $::FORM{'dontchange'}) {
-                if ($er_time > 99999.99) {
-                    ThrowUserError("value_out_of_range", {field => $field});
-                }
-                if ($er_time =~ /^(?:\d+(?:\.\d*)?|\.\d+)$/) {
-                    DoComma();
-                    $::query .= "$field = " . SqlQuote($er_time);
-                } else {
-                    ThrowUserError("need_positive_number",
-                                   {field => $field});
-                }
+                Bugzilla::Bug::ValidateTime($er_time, $field);
+                DoComma();
+                $::query .= "$field = " . SqlQuote($er_time);
             }
         }
     }
@@ -1274,9 +1267,7 @@ foreach my $id (@idlist) {
 
     delete $::FORM{'work_time'} unless UserInGroup(Param('timetrackinggroup'));
 
-    if ($::FORM{'work_time'} && $::FORM{'work_time'} > 99999.99) {
-        ThrowUserError("value_out_of_range", {field => 'work_time'});
-    }
+    Bugzilla::Bug::ValidateTime($::FORM{'work_time'}, 'work_time');
     if ($::FORM{'comment'} || $::FORM{'work_time'}) {
         if ($::FORM{'work_time'} && 
             (!defined $::FORM{'comment'} || $::FORM{'comment'} =~ /^\s*$/)) {