Bug 312933 Query.cgi leaks product names

Patch by Joel Peshkin <bugreport@peshkin.net> r=lpsolit, a=justdave

Bug 312933 Query.cgi leaks product names
a38539a7 · bugreport%peshkin.net · 22212e51 · a38539a7
Commit a38539a7 authored Oct 20, 2005 by bugreport%peshkin.net
Hide whitespace changes
Inline Side-by-side

Showing with 7 additions and 1 deletion

form.html.tmpl template/en/default/search/form.html.tmpl +7 -1

No files found.
--- a/template/en/default/search/form.html.tmpl
+++ b/template/en/default/search/form.html.tmpl
@@ -43,7 +43,13 @@ var tms = new Array();
 [% nclass = 0 %]
 [% FOREACH c = classification %]
  prods[[% nclass FILTER js %]] = [
-    [%- FOREACH item = c.products %]'[% item.name FILTER js %]'[% ", " UNLESS loop.last %] [%- END -%] ];
+    [% sep = '' %]
+    [%- FOREACH item = c.products -%]
+      [%- IF user.can_see_product(item.name) -%]
+        [%- sep FILTER js %]'[% item.name FILTER js %]'
+        [%- sep = ',' -%] 
+      [%- END -%]
+    [%- END -%] ];
  [% nclass = nclass+1 %]
 [% END %]