path: root/Bugzilla/CGI.pm

# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
#
# This Source Code Form is "Incompatible With Secondary Licenses", as
# defined by the Mozilla Public License, v. 2.0.

package Bugzilla::CGI;

use 5.10.1;
use strict;
use warnings;

use parent qw(CGI);

use Bugzilla::Constants;
use Bugzilla::Error;
use Bugzilla::Util;
use Bugzilla::Hook;
use Bugzilla::Search::Recent;

use File::Basename;
use HTTP::BrowserDetect;

sub _init_bz_cgi_globals {
  my $invocant = shift;

  # We need to disable output buffering - see bug 179174
  $| = 1;

  # Ignore SIGTERM and SIGPIPE - this prevents DB corruption. If the user closes
  # their browser window while a script is running, the web server sends these
  # signals, and we don't want to die half way through a write.
  $SIG{TERM} = 'IGNORE';
  $SIG{PIPE} = 'IGNORE';

  # We don't precompile any functions here, that's done specially in
  # mod_perl code.
  $invocant->_setup_symbols(qw(:no_xhtml :oldstyle_urls :private_tempfiles
      :unique_headers));
}

BEGIN { __PACKAGE__->_init_bz_cgi_globals() if i_am_cgi(); }

sub new {
  my ($invocant, @args) = @_;
  my $class = ref($invocant) || $invocant;

  # Under mod_perl, CGI's global variables get reset on each request,
  # so we need to set them up again every time.
  $class->_init_bz_cgi_globals() if $ENV{MOD_PERL};

  # RED HAT EXTENSION START 1881255
  my $self;

  eval { $self = $class->SUPER::new(@args); };

  # Catch CGI dieing
  if ($@) {
    if ($@ =~ m/Malformed multipart POST: data truncated/) {
      my $msg = <<'EOT';
The data posted was truncated, this has numerous causes.

Some know causes are:
  * the data provided was too large to be transferred
  * attempting to upload a file you don't have read access to

EOT

      die $msg;
    }
    else {
      die "CGI parsing error: $@";
    }
  }
  # RED HAT EXTENSION END 1881255

  # Make sure our outgoing cookie list is empty on each invocation
  $self->{Bugzilla_cookie_list} = [];

  # Path-Info is of no use for Bugzilla and interacts badly with IIS.
  # Moreover, it causes unexpected behaviors, such as totally breaking
  # the rendering of pages.
  my $script = basename($0);
  if (my $path_info = $self->path_info) {
    my @whitelist = ("rest.cgi");
    Bugzilla::Hook::process('path_info_whitelist', {whitelist => \@whitelist});
    if (!grep($_ eq $script, @whitelist)) {

      # IIS includes the full path to the script in PATH_INFO,
      # so we have to extract the real PATH_INFO from it,
      # else we will be redirected outside Bugzilla.
      my $script_name = $self->script_name;
      $path_info =~ s/^\Q$script_name\E//;
      if ($script_name && $path_info) {
        print $self->redirect($self->url(-path => 0, -query => 1));
      }
    }
  }

  # Send appropriate charset
  $self->charset(Bugzilla->params->{'utf8'} ? 'UTF-8' : '');

  # Redirect to urlbase/sslbase if we are not viewing an attachment.
  if ($self->url_is_attachment_base and $script ne 'attachment.cgi') {
    $self->redirect_to_urlbase();
  }

  # Check for errors
  # All of the Bugzilla code wants to do this, so do it here instead of
  # in each script

  my $err = $self->cgi_error;

  if ($err) {

    # Note that this error block is only triggered by CGI.pm for malformed
    # multipart requests, and so should never happen unless there is a
    # browser bug.

    print $self->header(-status => $err);

    # ThrowCodeError wants to print the header, so it grabs Bugzilla->cgi
    # which creates a new Bugzilla::CGI object, which fails again, which
    # ends up here, and calls ThrowCodeError, and then recurses forever.
    # So don't use it.
    # In fact, we can't use templates at all, because we need a CGI object
    # to determine the template lang as well as the current url (from the
    # template)
    # Since this is an internal error which indicates a severe browser bug,
    # just die.
    die "CGI parsing error: $err";
  }

  return $self;
}

# We want this sorted plus the ability to exclude certain params
sub canonicalise_query {
  my ($self, @exclude) = @_;

  # Reconstruct the URL by concatenating the sorted param=value pairs
  my @parameters;
  foreach my $key (sort($self->param())) {

    # Leave this key out if it's in the exclude list
    next if grep { $_ eq $key } @exclude;

    # Remove the Boolean Charts for standard query.cgi fields
    # They are listed in the query URL already
    next if $key =~ /^(field|type|value)(-\d+){3}$/;

    my $esc_key = url_quote($key);

    foreach my $value ($self->param($key)) {

      # Omit params with an empty value
      if (defined($value) && $value ne '') {
        my $esc_value = url_quote($value);

        push(@parameters, "$esc_key=$esc_value");
      }
    }
  }

  return join("&", @parameters);
}

sub clean_search_url {
  my $self = shift;

  # Delete any empty URL parameter.
  my @cgi_params = $self->param;

  foreach my $param (@cgi_params) {
    if (defined $self->param($param) && $self->param($param) eq '') {
      $self->delete($param);
      $self->delete("${param}_type");
    }

    # Custom Search stuff is empty if it's "noop". We also keep around
    # the old Boolean Chart syntax for backwards-compatibility.
    if ( ($param =~ /\d-\d-\d/ || $param =~ /^[[:alpha:]]\d+$/)
      && defined $self->param($param)
      && $self->param($param) eq 'noop')
    {
      $self->delete($param);
    }

    # Any "join" for custom search that's an AND can be removed, because
    # that's the default.
    if (($param =~ /^j\d+$/ || $param eq 'j_top') && $self->param($param) eq 'AND')
    {
      $self->delete($param);
    }
  }

  # Delete leftovers from the login form
  $self->delete('Bugzilla_remember', 'GoAheadAndLogIn');

  # Delete the token if we're not performing an action which needs it
  unless (
    (
      defined $self->param('remtype')
      && ( $self->param('remtype') eq 'asdefault'
        || $self->param('remtype') eq 'asnamed')
    )
    || (defined $self->param('remaction') && $self->param('remaction') eq 'forget')
    )
  {
    $self->delete("token");
  }

  foreach my $num (1, 2, 3) {

    # If there's no value in the email field, delete the related fields.
    if (!$self->param("email$num")) {
      ## REDHAT EXTENSION 876015: Add docs_contact
      foreach
        my $field (qw(type assigned_to reporter qa_contact docs_contact cc longdesc))
      {
        $self->delete("email$field$num");
      }
    }
  }

  # chfieldto is set to "Now" by default in query.cgi. But if none
  # of the other chfield parameters are set, it's meaningless.
  if ( !defined $self->param('chfieldfrom')
    && !$self->param('chfield')
    && !defined $self->param('chfieldvalue')
    && $self->param('chfieldto')
    && lc($self->param('chfieldto')) eq 'now')
  {
    $self->delete('chfieldto');
  }

  # cmdtype "doit" is the default from query.cgi, but it's only meaningful
  # if there's a remtype parameter.
  if ( defined $self->param('cmdtype')
    && $self->param('cmdtype') eq 'doit'
    && !defined $self->param('remtype'))
  {
    $self->delete('cmdtype');
  }

  # "Reuse same sort as last time" is actually the default, so we don't
  # need it in the URL.
  if ( $self->param('order')
    && $self->param('order') eq 'Reuse same sort as last time')
  {
    $self->delete('order');
  }

  # list_id is added in buglist.cgi after calling clean_search_url,
  # and doesn't need to be saved in saved searches.
  $self->delete('list_id');

  # no_redirect is used internally by redirect_search_url().
  $self->delete('no_redirect');

  # And now finally, if query_format is our only parameter, that
  # really means we have no parameters, so we should delete query_format.
  if ($self->param('query_format') && scalar($self->param()) == 1) {
    $self->delete('query_format');
  }
}

sub check_etag {
  my ($self, $valid_etag) = @_;

  # ETag support.
  my $if_none_match = $self->http('If-None-Match');
  return if !$if_none_match;

  my @if_none = split(/[\s,]+/, $if_none_match);
  foreach my $possible_etag (@if_none) {

    # remove quotes from begin and end of the string
    $possible_etag =~ s/^\"//g;
    $possible_etag =~ s/\"$//g;
    if ($possible_etag eq $valid_etag or $possible_etag eq '*') {
      return 1;
    }
  }

  return 0;
}

# Have to add the cookies in.
sub multipart_start {
  my $self = shift;

  my %args = @_;

  # CGI.pm::multipart_start doesn't honour its own charset information, so
  # we do it ourselves here
  if (defined $self->charset() && defined $args{-type}) {

    # Remove any existing charset specifier
    $args{-type} =~ s/;.*$//;

    # and add the specified one
    $args{-type} .= '; charset=' . $self->charset();
  }

  my $headers = $self->SUPER::multipart_start(%args);

  # Eliminate the one extra CRLF at the end.
  $headers =~ s/$CGI::CRLF$//;

  # Add the cookies. We have to do it this way instead of
  # passing them to multpart_start, because CGI.pm's multipart_start
  # doesn't understand a '-cookie' argument pointing to an arrayref.
  foreach my $cookie (@{$self->{Bugzilla_cookie_list}}) {
    $headers .= "Set-Cookie: ${cookie}${CGI::CRLF}";
  }
  $headers .= $CGI::CRLF;
  $self->{_multipart_in_progress} = 1;
  return $headers;
}

sub close_standby_message {
  my ($self, $contenttype, $disp, $disp_prefix, $extension) = @_;
  $self->set_dated_content_disp($disp, $disp_prefix, $extension);

  if ($self->{_multipart_in_progress}) {
    print $self->multipart_end();
    print $self->multipart_start(-type => $contenttype);
  }
  elsif (!$self->{_header_done}) {
    print $self->header($contenttype);
  }
}

sub is_safe_referer {
  my ($self) = @_;
  my $safe_referer_re = do {

    # Note that urlbase must end with a /.
    # It almost certainly does, but let's be extra careful.
    my $urlbase = correct_urlbase();
    ## RED HAT EXTENSION chop off trailing dirs as they are never in referrer
    $urlbase =~ s{([^\/])/[^\/].*$}{$1};
    $urlbase =~ s{/$}{};
    qr{
            # Begins with literal urlbase
            ^ (*COMMIT)
            \Q$urlbase\E
            # followed by a slash or end of string
            (?: /
              | $ )
        }sx
  };

  # Safe referers are ones that begin with the urlbase.
  my $referer = $self->referer;
  return $referer && $referer =~ $safe_referer_re;
}

our $ALLOW_UNSAFE_RESPONSE = 0;

# responding to text/plain or text/html is safe
# responding to any request with a referer header is safe
# some things need to have unsafe responses (attachment.cgi)
# everything else should get a 403.
sub _prevent_unsafe_response {
  my ($self, $headers) = @_;
  my $safe_content_type_re = qr{
        ^ (*COMMIT) # COMMIT makes the regex faster
                    # by preventing back-tracking. see also perldoc pelre.
        # application/x-javascript, xml, atom+xml, rdf+xml, xml-dtd, and json
        (?: application/ (?: x(?: -javascript | ml (?: -dtd )? )
                           | (?: atom | rdf) \+ xml
                           | json )
        # text/csv, text/calendar, text/plain, and text/html
          | text/ (?: c (?: alendar | sv )
                    | plain
                    | html )
        # used for HTTP push responses
          | multipart/x-mixed-replace)
    }sx;

  return if $ALLOW_UNSAFE_RESPONSE;

  if (Bugzilla->usage_mode == USAGE_MODE_BROWSER) {

    # Safe content types are ones that arn't images.
    # For now let's assume plain text and html are not valid images.
    my $content_type = $headers->{'-type'} // $headers->{'-content_type'}
      // 'text/html';
    my $is_safe_content_type = $content_type =~ $safe_content_type_re;

    if (!$self->is_safe_referer && !$is_safe_content_type) {
      print $self->SUPER::header(-type => 'text/html', -status => '403 Forbidden');
      if ($content_type ne 'text/html') {
        print "Untrusted Referer Header\n";
        if ($ENV{MOD_PERL}) {
          my $r = $self->r;
          $r->rflush;
          $r->status(200);
        }
      }
      exit;
    }
  }
}

# If CGI & the browser supports SameSite then we are OK
sub samesite_supported {
  my ($self) = @_;
  my %safe_browsers = (firefox => 61, chrome => 68,);

  if (CGI->VERSION >= 4.36) {
    my $ua      = HTTP::BrowserDetect->new($self->user_agent());
    my $browser = $ua->browser();
    my $version = $ua->browser_major();

    # Most browsers ship security fetaures to all OSs
    if ( $browser
      && defined $safe_browsers{$browser}
      && $version >= $safe_browsers{$browser})
    {
      return 1;
    }

    # Others are less diligent
    if ($browser && $browser eq 'edge' && $ua->os_string =~ m/^win10/) {
      return 1;
    }
  }

  return;
}

# Must restrict searches if the user is logged in, the request is a GET, and the referer isn't safe.
sub should_restrict_searches {
  my ($self) = @_;
  my $user   = Bugzilla->user;
  my $method = uc $self->request_method;

  return
       $user->id != 0
    && $method eq 'GET'
    && !$self->samesite_supported
    && !$self->is_safe_referer;
}

# Override header so we can add the cookies in
sub header {
  my $self = shift;

  my %headers;
  my $user = Bugzilla->user;

  # If there's only one parameter, then it's a Content-Type.
  if (scalar(@_) == 1) {
    %headers = ('-type' => shift(@_));
  }
  else {
    %headers = @_;
  }
  $self->_prevent_unsafe_response(\%headers);

  if ($self->{'_content_disp'}) {
    $headers{'-content_disposition'} = $self->{'_content_disp'};
  }

  if (!$user->id
    && $user->authorizer->can_login
    && !$self->cookie('Bugzilla_login_request_cookie'))
  {
    my %args;
    $args{'-secure'} = 1 if Bugzilla->params->{ssl_redirect};

    $self->send_cookie(
      -name     => 'Bugzilla_login_request_cookie',
      -value    => generate_random_password(),
      -httponly => 1,
      %args
    );
  }

  # Add the cookies in if we have any
  if (scalar(@{$self->{Bugzilla_cookie_list}})) {
    $headers{'-cookie'} = $self->{Bugzilla_cookie_list};
  }

  # Add Strict-Transport-Security (STS) header if this response
  # is over SSL and the strict_transport_security param is turned on.
  if ( $self->https
    && !$self->url_is_attachment_base
    && Bugzilla->params->{'strict_transport_security'} ne 'off')
  {
    my $sts_opts = 'max-age=' . MAX_STS_AGE;
    if (Bugzilla->params->{'strict_transport_security'} eq 'include_subdomains') {
      $sts_opts .= '; includeSubDomains';
    }

    $headers{'-strict_transport_security'} = $sts_opts;
  }

  # Add X-Frame-Options header to prevent framing and subsequent
  # possible clickjacking problems.
  unless ($self->url_is_attachment_base) {
    $headers{'-x_frame_options'} = 'SAMEORIGIN';
  }

  # Add X-XSS-Protection header to prevent simple XSS attacks
  # and enforce the blocking (rather than the rewriting) mode.
  $headers{'-x_xss_protection'} = '1; mode=block';

  # Add X-Content-Type-Options header to prevent browsers sniffing
  # the MIME type away from the declared Content-Type.
  $headers{'-x_content_type_options'} = 'nosniff';

  Bugzilla::Hook::process('cgi_headers', {cgi => $self, headers => \%headers});
  $self->{_header_done} = 1;

  return $self->SUPER::header(%headers) || "";
}

sub param {
  my $self = shift;
  local $CGI::LIST_CONTEXT_WARN = 0;

  # When we are just requesting the value of a parameter...
  if (scalar(@_) == 1) {
    my @result = $self->SUPER::param(@_);

    # Also look at the URL parameters, after we look at the POST
    # parameters. This is to allow things like login-form submissions
    # with URL parameters in the form's "target" attribute.
    if ( !scalar(@result)
      && $self->request_method
      && $self->request_method eq 'POST')
    {
      @result = $self->url_param(@_);
    }

    # Fix UTF-8-ness of input parameters.
    if (Bugzilla->params->{'utf8'}) {
      @result = map { _fix_utf8($_) } @result;
    }

    return wantarray ? @result : $result[0];
  }

  # And for various other functions in CGI.pm, we need to correctly
  # return the URL parameters in addition to the POST parameters when
  # asked for the list of parameters.
  elsif (!scalar(@_) && $self->request_method && $self->request_method eq 'POST')
  {
    my @post_params = $self->SUPER::param;
    my @url_params  = $self->url_param;
    my %params      = map { $_ => 1 } (@post_params, @url_params);
    return keys %params;
  }

  return $self->SUPER::param(@_);
}

sub url_param {
  my $self = shift;

  # Some servers fail to set the QUERY_STRING parameter, which
  # causes undef issues
  $ENV{'QUERY_STRING'} //= '';
  return $self->SUPER::url_param(@_);
}

sub _fix_utf8 {
  my $input = shift;

  # The is_utf8 is here in case CGI gets smart about utf8 someday.
  utf8::decode($input) if defined $input && !ref $input && !utf8::is_utf8($input);
  return $input;
}

sub should_set {
  my ($self, $param) = @_;
  my $set
    = (defined $self->param($param) or defined $self->param("defined_$param"))
    ? 1
    : 0;
  return $set;
}

sub cookie {
  my ($self, @args) = @_;

  # Called with one arg to read a cookie
  if (@args == 1) {
    return undef if Bugzilla->request_cache->{nocookies};

    my $origin  = $self->http('Origin');
    my $urlbase = correct_urlbase();
    ## RED HAT EXTENSION chop off trailing dirs as they are never in referrer
    $urlbase =~ s{([^\/])/[^\/].*$}{$1};
    $urlbase =~ s{/$}{};
    if ($origin && $urlbase ne $origin) {
      ## RED HAT EXTENSION 1623795 - Don't cache as it breaks SSO
      #Bugzilla->request_cache->{nocookies} = 1;
      return;
    }
  }

  return $self->SUPER::cookie(@args);
}

# The various parts of Bugzilla which create cookies don't want to have to
# pass them around to all of the callers. Instead, store them locally here,
# and then output as required from |header|.
sub send_cookie {
  my $self = shift;

  # Move the param list into a hash for easier handling.
  my %paramhash;
  my @paramlist;
  my ($key, $value);
  while ($key = shift) {
    $value = shift;
    $paramhash{$key} = $value;
  }

  # Complain if -value is not given or empty (bug 268146).
  if (!exists($paramhash{'-value'}) || !$paramhash{'-value'}) {
    ThrowCodeError('cookies_need_value');
  }

  if (CGI->VERSION >= 4.36) {
    $paramhash{'-samesite'} = 'Lax';
  }

  # Add the default path and the domain in.
  $paramhash{'-path'}   = Bugzilla->params->{'cookiepath'};
  $paramhash{'-domain'} = Bugzilla->params->{'cookiedomain'}
    if Bugzilla->params->{'cookiedomain'};

  # Move the param list back into an array for the call to cookie().
  foreach (keys(%paramhash)) {
    unshift(@paramlist, $_ => $paramhash{$_});
  }

  push(@{$self->{'Bugzilla_cookie_list'}}, $self->cookie(@paramlist));
}

# Cookies are removed by setting an expiry date in the past.
# This method is a send_cookie wrapper doing exactly this.
sub remove_cookie {
  my $self = shift;
  my ($cookiename) = (@_);

  # Expire the cookie, giving a non-empty dummy value (bug 268146).
  $self->send_cookie(
    '-name'    => $cookiename,
    '-expires' => 'Tue, 15-Sep-1998 21:49:00 GMT',
    '-value'   => 'X'
  );
}

# This helps implement Bugzilla::Search::Recent, and also shortens search
# URLs that get POSTed to buglist.cgi.
sub redirect_search_url {
  my $self = shift;

  # If there is no parameter, there is nothing to do.
  return unless $self->param;

  # If we're retreiving an old list, we never need to redirect or
  # do anything related to Bugzilla::Search::Recent.
  return if $self->param('regetlastlist');

  my $user = Bugzilla->user;

  if ($user->id) {

    # There are two conditions that could happen here--we could get a URL
    # with no list id, and we could get a URL with a list_id that isn't
    # ours.
    my $list_id = $self->param('list_id');
    if ($list_id) {

      # If we have a valid list_id, no need to redirect or clean.
      return if Bugzilla::Search::Recent->check_quietly({id => $list_id});
    }
  }
  elsif ($self->request_method ne 'POST') {

    # Logged-out users who do a GET don't get a list_id, don't get
    # their URLs cleaned, and don't get redirected.
    return;
  }

  my $no_redirect = 1;#$self->param('no_redirect');
  $self->clean_search_url();

  # Make sure we still have params still after cleaning otherwise we
  # do not want to store a list_id for an empty search.
  if ($user->id && $self->param) {

    # Insert a placeholder Bugzilla::Search::Recent, so that we know what
    # the id of the resulting search will be. This is then pulled out
    # of the Referer header when viewing show_bug.cgi to know what
    # bug list we came from.
    my $recent_search = Bugzilla::Search::Recent->create_placeholder;
    $self->param('list_id', $recent_search->id);
  }

  # Browsers which support history.replaceState do not need to be
  # redirected. We can fix the URL on the fly.
  return if $no_redirect;

  # GET requests that lacked a list_id are always redirected. POST requests
  # are only redirected if they're under the CGI_URI_LIMIT though.
  my $self_url = $self->url(-relative => 1, -path => 1, -query => 1);
  if ($self->request_method() ne 'POST' or length($self_url) < CGI_URI_LIMIT) {
    print $self->redirect(-url => $self_url);
    exit;
  }
}

sub redirect_to_https {
  my $self    = shift;
  my $sslbase = Bugzilla->params->{'sslbase'};

  # If this is a POST, we don't want ?POSTDATA in the query string.
  # We expect the client to re-POST, which may be a violation of
  # the HTTP spec, but the only time we're expecting it often is
  # in the WebService, and WebService clients usually handle this
  # correctly.
  $self->delete('POSTDATA');
  my $url
    = $sslbase . $self->url('-path_info' => 1, '-query' => 1, '-relative' => 1);

  # XML-RPC clients (SOAP::Lite at least) require a 301 to redirect properly
  # and do not work with 302. Our redirect really is permanent anyhow, so
  # it doesn't hurt to make it a 301.
  print $self->redirect(-location => $url, -status => 301);

  # When using XML-RPC with mod_perl, we need the headers sent immediately.
  $self->r->rflush if $ENV{MOD_PERL};
  exit;
}

# Redirect to the urlbase version of the current URL.
sub redirect_to_urlbase {
  my $self = shift;
  my $path = $self->url('-path_info' => 1, '-query' => 1, '-relative' => 1);
  print $self->redirect('-location' => correct_urlbase() . $path);
  exit;
}

sub url_is_attachment_base {
  my ($self, $id) = @_;
  return 0 if !use_attachbase() or !i_am_cgi();
  my $attach_base = Bugzilla->params->{'attachment_base'};

  # If we're passed an id, we only want one specific attachment base
  # for a particular bug. If we're not passed an ID, we just want to
  # know if our current URL matches the attachment_base *pattern*.
  my $regex;
  if ($id) {
    $attach_base =~ s/\%bugid\%/$id/;
    $regex = quotemeta($attach_base);
  }
  else {
    # In this circumstance we run quotemeta first because we need to
    # insert an active regex meta-character afterward.
    $regex = quotemeta($attach_base);
    $regex =~ s/\\\%bugid\\\%/\\d+/;
  }
  $regex = "^$regex";
  ## RED HAT EXTENSION START 1657579
  # If behind a proxy you might be on port 80, even though the public url is SSL
  $regex =~ s/^https:/https?:/ if (Bugzilla->params->{'inbound_proxies'} ne '');
  ## RED HAT EXTENSION END 1657579

  ## RED HAT EXTENSION START 1658655
  my $url = $self->url;

  ## REDHAT EXTENSION START 1991359
  # Replace internal host name with server name user was trying to get to
  if (Bugzilla->params->{'edge_host_header'} ne '') {
    my $host   = $ENV{HTTP_HOST};
    my $header = uc(Bugzilla->params->{'edge_host_header'});
    $header =~ s/-/_/g;
    my $real_target = $ENV{$header};
    $url =~ s{^(https?://)$host/}{$1$real_target/} if ($real_target);
  }
  ## REDHAT EXTENSION END 1991359

  return ($url =~ $regex) ? 1 : 0;
  ## RED HAT EXTENSION END 1658655
}

sub set_dated_content_disp {
  my ($self, $type, $prefix, $ext) = @_;

  my @time = localtime(time());
  my $date = sprintf "%04d-%02d-%02d", 1900 + $time[5], $time[4] + 1, $time[3];
  my $filename = "$prefix-$date.$ext";

  $filename =~ s/\s/_/g;     # Remove whitespace to avoid HTTP header tampering
  $filename =~ s/\\/_/g;     # Remove backslashes as well
  $filename =~ s/"/\\"/g;    # escape quotes

  my $disposition = "$type; filename=\"$filename\"";

  $self->{'_content_disp'} = $disposition;
}

##########################
# Vars TIEHASH Interface #
##########################

# Fix the TIEHASH interface (scalar $cgi->Vars) to return and accept
# arrayrefs.
sub STORE {
  my $self = shift;
  my ($param, $value) = @_;
  if (defined $value and ref $value eq 'ARRAY') {
    return $self->param(-name => $param, -value => $value);
  }
  return $self->SUPER::STORE(@_);
}

sub FETCH {
  my ($self, $param) = @_;
  return $self if $param eq 'CGI';    # CGI.pm did this, so we do too.
  my @result = $self->param($param);
  return undef if !scalar(@result);
  return $result[0] if scalar(@result) == 1;
  return \@result;
}

# For the Vars TIEHASH interface: the normal CGI.pm DELETE doesn't return
# the value deleted, but Perl's "delete" expects that value.
sub DELETE {
  my ($self, $param) = @_;
  my $value = $self->FETCH($param);
  $self->delete($param);
  return $value;
}
1;

__END__

=head1 NAME

Bugzilla::CGI - CGI handling for Bugzilla

=head1 SYNOPSIS

  use Bugzilla::CGI;

  my $cgi = new Bugzilla::CGI();

=head1 DESCRIPTION

This package inherits from the standard CGI module, to provide additional
Bugzilla-specific functionality. In general, see L<the CGI.pm docs|CGI> for
documention.

=head1 CHANGES FROM L<CGI.PM|CGI>

Bugzilla::CGI has some differences from L<CGI.pm|CGI>.

=over 4

=item C<cgi_error> is automatically checked

After creating the CGI object, C<Bugzilla::CGI> automatically checks
I<cgi_error>, and throws a CodeError if a problem is detected.

=back

=head1 ADDITIONAL FUNCTIONS

I<Bugzilla::CGI> also includes additional functions.

=over 4

=item C<canonicalise_query(@exclude)>

This returns a sorted string of the parameters whose values are non-empty,
suitable for use in a url.

Values in C<@exclude> are not included in the result.

=item C<send_cookie>

This routine is identical to the cookie generation part of CGI.pm's C<cookie>
routine, except that it knows about Bugzilla's cookie_path and cookie_domain
parameters and takes them into account if necessary.
This should be used by all Bugzilla code (instead of C<cookie> or the C<-cookie>
argument to C<header>), so that under mod_perl the headers can be sent
correctly, using C<print> or the mod_perl APIs as appropriate.

To remove (expire) a cookie, use C<remove_cookie>.

=item C<remove_cookie>

This is a wrapper around send_cookie, setting an expiry date in the past,
effectively removing the cookie.

As its only argument, it takes the name of the cookie to expire.

=item C<redirect_to_https>

This routine redirects the client to the https version of the page that
they're looking at, using the C<sslbase> parameter for the redirection.

Generally you should use L<Bugzilla::Util/do_ssl_redirect_if_required>
instead of calling this directly.

=item C<redirect_to_urlbase>

Redirects from the current URL to one prefixed by the urlbase parameter.

=item C<multipart_start>

Starts a new part of the multipart document using the specified MIME type.
If not specified, text/html is assumed.

=item C<close_standby_message>

Ends a part of the multipart document, and starts another part.

=item C<set_dated_content_disp>

Sets an appropriate date-dependent value for the Content Disposition header
for a downloadable resource.


=item C<samesite_supported>

Check if the CGI module on the server and browser both support SameSite cookies.

=back

=head1 SEE ALSO

L<CGI|CGI>, L<CGI::Cookie|CGI::Cookie>

=head1 B<Methods in need of POD>

=over

=item check_etag

=item clean_search_url

=item url_is_attachment_base

=item should_set

=item redirect_search_url

=item param

=item url_param

=item header

=item should_restrict_searches

=item cookie

=item is_safe_referer

=back