fix the arrayref leaking into the myurl function problem

diff --git a/cgi/pkgreport.cgi b/cgi/pkgreport.cgi
index 444b6674215663675f5db118a6473da9af8c6903..1f2294cf8449b5f00854811687fccba6cb60cc8b 100755 (executable)
--- a/cgi/pkgreport.cgi
+++ b/cgi/pkgreport.cgi
@@ -418,12 +418,13 @@ if (defined $pkg || defined $src) {
 
 set_option("archive", !$archive);
 printf "<p>See the <a href=\"%s\">%s reports</a></p>",
-     urlsanit('pkgreport.cgi?'.join(';',
-                                   (map {$_ eq 'archive'?():("$_=$param{$_}")
-                                    } keys %param
-                                   ),
-                                   ('archive='.($archive?"no":"yes"))
-                                  )
+     urlsanit(pkg_url((
+                      map {
+                           $_ eq 'archive'?():($_,$param{$_})
+                      } keys %param
+                     ),
+                     ('archive',($archive?"no":"yes"))
+                    )
             ), ($archive ? "active" : "archived");
 set_option("archive", $archive);
 
@@ -463,10 +464,10 @@ if (defined $pkg) {
 }
 print "<tr><td>&nbsp;</td></tr>\n";
 
-my $includetags = htmlsanit(join(" ", grep { !m/^subj:/i } split /[\s,]+/, $include));
-my $excludetags = htmlsanit(join(" ", grep { !m/^subj:/i } split /[\s,]+/, $exclude));
-my $includesubj = htmlsanit(join(" ", map { s/^subj://i; $_ } grep { m/^subj:/i } split /[\s,]+/, $include));
-my $excludesubj = htmlsanit(join(" ", map { s/^subj://i; $_ } grep { m/^subj:/i } split /[\s,]+/, $exclude));
+my $includetags = htmlsanit(join(" ", grep { !m/^subj:/i } map {split /[\s,]+/} ref($include)?@{$include}:$include));
+my $excludetags = htmlsanit(join(" ", grep { !m/^subj:/i } map {split /[\s,]+/} ref($exclude)?@{$exclude}:$exclude));
+my $includesubj = htmlsanit(join(" ", map { s/^subj://i; $_ } grep { m/^subj:/i } map {split /[\s,]+/} ref($include)?@{$include}:$include));
+my $excludesubj = htmlsanit(join(" ", map { s/^subj://i; $_ } grep { m/^subj:/i } map {split /[\s,]+/} ref($exclude)?@{$exclude}:$exclude));
 my $vismindays = ($mindays == 0 ? "" : $mindays);
 my $vismaxdays = ($maxdays == -1 ? "" : $maxdays);
 
@@ -899,12 +900,10 @@ sub pkg_htmlselectarch {
 }
 
 sub myurl {
-     return urlsanit('pkgreport.cgi?'.
-                    join(';',
-                         (map {("$_=$param{$_}")
-                                           } keys %param
-                         )
-                        )
+     return urlsanit(pkg_url(map {exists $param{$_}?($_,$param{$_}):()}
+                            qw(archive repeatmerged mindays maxdays),
+                            qw(version dist arch pkg src tag maint submitter)
+                           )
                    );
 }
 

diff --git a/debian/changelog b/debian/changelog
index f3fb3944c7cdc85cdd0bd82518e2d6d2b17b31b0..87356ccf54d98df58944784c9aca92075a74bcc7 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -145,6 +145,7 @@ debbugs (2.4.2) UNRELEASED; urgency=low
     - Fix broken sorting by usertags by forcing numeric (closes: #395027)
     - Add support for hiding useless messages; thanks to Sune Vuorela.
       (closes: #406020)
+    - Fix arrayrefs leaking into the myurl function (closes: #397344)
 
   
  -- Colin Watson <cjwatson@debian.org>  Fri, 20 Jun 2003 18:57:25 +0100