~bgo-maintainers/bugzilla.gnome.org/3.4 : changes

~bgo-maintainers/bugzilla.gnome.org/3.4 » Changes from revision 6730

From Revision 6730 to 6711

Rev	Summary	Authors	Date
6730	I think I am merging here, but I don't really know I think I am merging here, but I don't really know	Tobias Mueller	9 years ago
6729	Backported relevant hunks of the CVE-2014-1573 patch Backported relevant hunks of the CVE-2014-1573 patch This is being tracked at https://bugzilla.mozilla.org/show_bug.cgi?id=1075578 The hunks of the Attachment.pm reg. the contenttypemethod needed to be adapted manually as they didn't fit out of the box. But it was easy enough and it shouldn't break anything. Some other hunks didn't not apply, but it seems that the architecture of this Bugzilla 3 is sufficiently different so that the modifications are not necessary. I.e. when creating attachments (e.g. in post_bug), we apparently cannot provide a URL, so this cannot be an attack vector. However, I don't really understand how the actual attachments (i.e. the file contents of an upload) are created. So I am not able to assess whether we are vulnerable here. The buglist.pm hunks didn't apply for new Bugzilla::Product. We do not use the CGI input directly, so I guess we are doing fine. As far as I can see, the GroupCheck in editgroups.pm works as intended, so we do not need to patch.	Tobias Mueller	9 years ago
6728	Fix for upstream Bug 745397 - (CVE-2012-0466) [SECURITY] The... Fix for upstream Bug 745397 - (CVE-2012-0466) [SECURITY] The JS template for buglists permits attackers to access all bugs that the victim can see	Christian Kirbach	11 years ago
6727	Fix for Bug 785470 - (CVE-2012-3981) [SECURITY] Missing esca... Fix for Bug 785470 - (CVE-2012-3981) [SECURITY] Missing escaping of the username can lead to LDAP injection	Christian Kirbach	11 years ago
6726	Apply upstream Bug 842038 - (CVE-2013-0785) [SECURITY] XSS i... Apply upstream Bug 842038 - (CVE-2013-0785) [SECURITY] XSS in show_bug.cgi when using an invalid page format	Christian Kirbach	11 years ago
6725	Config/Query.pm: Make My Bugs direct to the describeuser pag... Config/Query.pm: Make My Bugs direct to the describeuser page. Fixes bgo#601250 We have the entire "My Bugs" story handled by the "describeuser" page.	Tobias Mueller	12 years ago
6724	Make My Bugs search for NEEDINFO bugs, too. Fixes bgo#601250 Make My Bugs search for NEEDINFO bugs, too. Fixes bgo#601250 From a quick grep through the code, this seems to be the necessary change to fix https://bugzilla.gnome.org/show_bug.cgi?id=601250	Tobias Mueller	12 years ago
6723	merge upstream changes merge upstream changes	Olav Vitters	12 years ago
6722	merge upstream changes merge upstream changes	Olav Vitters	12 years ago
6721	merge upstream changes merge upstream changes	Olav Vitters	12 years ago
6720	Nicer ftpadmin output Nicer ftpadmin output	Olav Vitters	12 years ago
6719	require editclassifications to change GNOME target field require editclassifications to change GNOME target field	Olav Vitters	13 years ago
6718	require editclassifications to change GNOME target field require editclassifications to change GNOME target field	Olav Vitters	13 years ago
6717	Merge with upstream Merge with upstream	Olav Vitters	13 years ago
6716	Merge with upstream Merge with upstream	Olav Vitters	13 years ago
6715	Add IP address of new master.gnome.org VM to list of allowed... Add IP address of new master.gnome.org VM to list of allowed hosts	Olav Vitters	13 years ago
6714	Merge with upstream (security fixes) Merge with upstream (security fixes)	Olav Vitters	13 years ago
6713	Merge with upstream Merge with upstream	Olav Vitters	13 years ago
6712	Add warnings regarding automatic data retrieval Add warnings regarding automatic data retrieval	Olav Vitters	13 years ago
6711	Merge with upstream changes Merge with upstream changes Speed up show_bug.cgi, avoid some error_log messages.	Olav Vitters	14 years ago

Older »