bugzilla/bugzilla-3.2.10-CVE-2012-0448.patch
Xavier Bachelot 74dae0d782 CVE-2012-0448
2012-02-01 21:53:41 +01:00

52 lines
2.5 KiB
Diff

diff -Naur Bugzilla/Util.pm Bugzilla/Util.pm
--- Bugzilla/Util.pm 2011-01-24 23:07:59.000000000 +0100
+++ Bugzilla/Util.pm 2012-02-01 09:17:53.414276564 +0100
@@ -559,7 +559,7 @@
sub validate_email_syntax {
my ($addr) = @_;
my $match = Bugzilla->params->{'emailregexp'};
- my $ret = ($addr =~ /$match/ && $addr !~ /[\\\(\)<>&,;:"\[\] \t\r\n]/);
+ my $ret = ($addr =~ /$match/ && $addr !~ /[\\\(\)<>&,;:"\[\] \t\r\n\P{ASCII}]/);
if ($ret) {
# We assume these checks to suffice to consider the address untainted.
trick_taint($_[0]);
diff -Naur editflagtypes.cgi editflagtypes.cgi
--- editflagtypes.cgi 2009-02-02 20:01:12.000000000 +0100
+++ editflagtypes.cgi 2012-02-01 09:17:53.415276556 +0100
@@ -578,7 +578,7 @@
# - do not contain any illegal character.
foreach my $address (@addresses) {
($address =~ /^[\w\.\+\-=]+@[\w\.\-]+\.[\w\-]+$/
- && $address !~ /[\\\(\)<>&,;:"\[\] \t\r\n]/)
+ && $address !~ /[\\\(\)<>&,;:"\[\] \t\r\n\P{ASCII}]/)
|| ThrowUserError('illegal_email_address',
{addr => $address, default => 1});
}
diff -Naur template/en/default/global/code-error.html.tmpl template/en/default/global/code-error.html.tmpl
--- template/en/default/global/code-error.html.tmpl 2012-02-01 09:17:00.561730124 +0100
+++ template/en/default/global/code-error.html.tmpl 2012-02-01 09:17:53.415276556 +0100
@@ -58,8 +58,7 @@
[% ELSE %]
[%+ Param('emailregexpdesc') %]
[% END %]
- It must also not contain any of these special characters:
- <tt>\ ( ) &amp; &lt; &gt; , ; : &quot; [ ]</tt>, or any whitespace.
+ It also must not contain any illegal characters.
[% ELSIF error == "authres_unhandled" %]
The result value of [% value FILTER html %] was not handled by
diff -Naur template/en/default/global/user-error.html.tmpl template/en/default/global/user-error.html.tmpl
--- template/en/default/global/user-error.html.tmpl 2012-02-01 09:17:00.557730158 +0100
+++ template/en/default/global/user-error.html.tmpl 2012-02-01 09:17:53.417276540 +0100
@@ -748,9 +748,8 @@
[% ELSE %]
[%+ Param('emailregexpdesc') %]
[% END %]
- It must also not contain any of these special characters:
- <tt>\ ( ) &amp; &lt; &gt; , ; : &quot; [ ]</tt>, or any whitespace.
-
+ It also must not contain any illegal characters.
+
[% ELSIF error == "illegal_frequency" %]
[% title = "Too Frequent" %]
Unless you are an administrator, you may not create series which are