diff options
author | 2013-02-19 18:11:40 +0100 | |
---|---|---|
committer | 2013-02-19 18:11:40 +0100 | |
commit | e2c8da0dfc534ffca6232cc7d370299d5d446604 (patch) | |
tree | 94031fcc7203f315398ddb7d3055908769e99294 /report.cgi | |
parent | Bug 832262: Release notes for Bugzilla 4.4rc2 (diff) | |
download | bugzilla-e2c8da0dfc534ffca6232cc7d370299d5d446604.tar.gz bugzilla-e2c8da0dfc534ffca6232cc7d370299d5d446604.tar.bz2 bugzilla-e2c8da0dfc534ffca6232cc7d370299d5d446604.zip |
Bug 824399: (CVE-2013-0786) [SECURITY] build_subselect() leaks the existence of products and components you cannot access
r/a=LpSolit
Diffstat (limited to 'report.cgi')
-rwxr-xr-x | report.cgi | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/report.cgi b/report.cgi index 2949a18c3..5e51bd34a 100755 --- a/report.cgi +++ b/report.cgi @@ -258,7 +258,13 @@ $vars->{'width'} = $width; $vars->{'height'} = $height; $vars->{'queries'} = $extra_data; $vars->{'saved_report_id'} = $cgi->param('saved_report_id'); -$vars->{'debug'} = $cgi->param('debug'); + +if ($cgi->param('debug') + && Bugzilla->params->{debug_group} + && Bugzilla->user->in_group(Bugzilla->params->{debug_group}) +) { + $vars->{'debug'} = 1; +} if ($action eq "wrap") { # So which template are we using? If action is "wrap", we will be using |