-
Thomas Sibley authored
Specifying a defined Graph argument to RT::Graph::Tickets->TicketLinks is only used internally when it is called recursively. Since Graph is expected to be an existing GraphViz object if defined, it never makes sense to start with anything but an undefined Graph parameter. This prevents a user-supplied Graph parameter from having ->add_node called on it. Since the Graph parameter could contain a Perl package name, it previously provided a means to call to ->add_node on arbitrary Perl packages already loaded into memory. While of unlikely utility, there's no reason to allow such behaviour. Fixes part of CVE-2011-4458.
04a9551f