Skip to content

bugzilla
bugzilla
Commit 53bd4df6 authored by justdave%bugzilla.org's avatar justdave%bugzilla.org
Browse files
Options

[SECURITY] Bug 263780: Exporting a bug to XML exposes user comments and…

[SECURITY] Bug 263780: Exporting a bug to XML exposes user comments and attachment summaries which are marked as private to users who are not members of the group allowed to see private comments and attachments. XML export is not exposed in the user interface, but is available to anyone who knows the correct URL to invoke it. This only affects sites that use the 'insidergroup' feature. Patch by Joel Peshkin <bugreport@peshkin.net> r=vladd,justdave, a=justdave
parent 23df77be
Hide whitespace changes
Inline Side-by-side
Showing with 6 additions and 0 deletions
show_bug.cgi
View file @ 53bd4df6
...@@ -113,6 +113,10 @@ if ($cgi->param("field")) { ...@@ -113,6 +113,10 @@ if ($cgi->param("field")) {
@fieldlist = $cgi->param("field"); @fieldlist = $cgi->param("field");
} }
unless (UserInGroup(Param("timetrackinggroup"))) {
@fieldlist = grep($_ !~ /_time$/, @fieldlist);
}
foreach (@fieldlist) { foreach (@fieldlist) {
$displayfields{$_} = 1; $displayfields{$_} = 1;
} }
......
template/en/default/bug/show.xml.tmpl
View file @ 53bd4df6
...@@ -53,6 +53,7 @@ ...@@ -53,6 +53,7 @@
[% IF displayfields.long_desc %] [% IF displayfields.long_desc %]
[% FOREACH c = bug.longdescs %] [% FOREACH c = bug.longdescs %]
[% NEXT IF c.isprivate && !UserInGroup(Param("insidergroup")) %]
<long_desc> <long_desc>
<who>[% c.email FILTER xml %]</who> <who>[% c.email FILTER xml %]</who>
<bug_when>[% c.time FILTER time FILTER xml %]</bug_when> <bug_when>[% c.time FILTER time FILTER xml %]</bug_when>
...@@ -63,6 +64,7 @@ ...@@ -63,6 +64,7 @@
[% IF displayfields.attachment %] [% IF displayfields.attachment %]
[% FOREACH a = bug.attachments %] [% FOREACH a = bug.attachments %]
[% NEXT IF a.isprivate && !UserInGroup(Param("insidergroup")) %]
<attachment> <attachment>
<attachid>[% a.attachid %]</attachid> <attachid>[% a.attachid %]</attachid>
<date>[% a.date FILTER time FILTER xml %]</date> <date>[% a.date FILTER time FILTER xml %]</date>
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment