mantisbt/trunk/CVE-2014-8986.patch

   1 diff -rupN mantisbt-1.2.19.orig/adm_config_report.php mantisbt-1.2.19/adm_config_report.php
   2 --- mantisbt-1.2.19.orig/adm_config_report.php  2015-02-17 11:36:02.025998608 +0100
   3 +++ mantisbt-1.2.19/adm_config_report.php       2015-02-17 11:42:22.122773322 +0100
   4 @@ -159,6 +159,16 @@
   5                 }
   6         }
   7
   8 +       if( !is_blank( $t_filter_config_value ) && (int)$t_filter_config_value !== META_FILTER_NONE ) {
   9 +               // check that config value exists
  10 +               if( @config_get_global( $t_filter_config_value ) === null ) {
  11 +                       $t_cookie_path = config_get( 'cookie_path' );
  12 +                       gpc_clear_cookie( $t_cookie_name, $t_cookie_path );
  13 +
  14 +                       trigger_error( ERROR_GENERIC, ERROR );
  15 +               }
  16 +       }
  17 +
  18         # Get config edit values
  19         $t_edit_user_id         = gpc_get_int( 'user_id', $t_filter_user_value == META_FILTER_NONE ? ALL_USERS : $t_filter_user_value );
  20         $t_edit_project_id      = gpc_get_int( 'project_id', $t_filter_project_value == META_FILTER_NONE ? ALL_PROJECTS : $t_filter_project_value );