Bug 335354: editparams.cgi crashes when editing the 'languages' and 'defaultlanguage' parameters - Patch by Frédéric Buclin <LpSolit@gmail.com> r=wurblzap a=LpSolit

2 files changed, 13 insertions, 2 deletions

diff --git a/Bugzilla/Config/Common.pm b/Bugzilla/Config/Common.pm
index 0d6db5257..c309059d2 100644
--- a/Bugzilla/Config/Common.pm
+++ b/Bugzilla/Config/Common.pm
@@ -285,17 +285,26 @@ sub check_image_converter {
 }
 
 sub check_languages {
-    my @languages = split /[,\s]+/, trim($_[0]);
+    my ($lang, $param) = @_;
+    my @languages = split(/[,\s]+/, trim($lang));
     if(!scalar(@languages)) {
        return "You need to specify a language tag."
     }
+    if (scalar(@languages) > 1 && $param && $param->{'name'} eq 'defaultlanguage') {
+        return "You can only specify one language tag";
+    }
     my $templatedir = bz_locations()->{'templatedir'};
+    my %lang_seen;
+    my @validated_languages;
     foreach my $language (@languages) {
        if(   ! -d "$templatedir/$language/custom" 
           && ! -d "$templatedir/$language/default") {
           return "The template directory for $language does not exist";
        }
+       push(@validated_languages, $language) unless $lang_seen{$language}++;
     }
+    # Rebuild the list of language tags, avoiding duplicates.
+    $_[0] = join(', ', @validated_languages);
     return "";
 }
 
diff --git a/editparams.cgi b/editparams.cgi
index ca74df685..b4100a0b1 100755
--- a/editparams.cgi
+++ b/editparams.cgi
@@ -145,7 +145,9 @@ if ($action eq 'save' && $current_module) {
         # then we delete it (the user pref is reset to the default one).
         my @languages = split(/[\s,]+/, Bugzilla->params->{'languages'});
         map {trick_taint($_)} @languages;
-        add_setting('lang', \@languages, Bugzilla->params->{'defaultlanguage'}, undef, 1);
+        my $lang = Bugzilla->params->{'defaultlanguage'};
+        trick_taint($lang);
+        add_setting('lang', \@languages, $lang, undef, 1);
     }
 
     $vars->{'message'} = 'parameters_updated';