Allow to use field names in email_in.pl, do not use CGI tie, use Bugzilla->input_params, fix some warnings

Bugzilla.pm

@@ -491,10 +491,8 @@ sub input_params
     }
     return $cache->{input_params} if defined $cache->{input_params};
 
-    # Making this scalar makes it a tied hash to the internals of $cgi,
+    # Throw away the tie.
-    # so if a variable is changed, then it actually changes the $cgi object
+    $cache->{input_params} = { %{ $class->cgi->Vars } };
-    # as well.
-    $cache->{input_params} = $class->cgi->Vars;
     return $cache->{input_params};
 }
 
@@ -974,6 +972,7 @@ sub fieldvaluecontrol
         my $has = {};
         for (@$rows)
         {
+            next if !defined $_->{dep_field_id}; # FIXME: means fieldvaluecontrol table has inconsistent data
             if ($_->{value_id} > 0)
             {
                 # Show value_id if value_field==visibility_value_id

Bugzilla/Attachment.pm

@@ -1131,9 +1131,10 @@ sub get_content_type
 # CustIS Bug 68919 - Create multiple attachments to bug
 sub add_multiple
 {
-    my ($bug, $cgi) = @_;
+    my ($bug) = @_;
     my $multiple = {};
-    my $params = $cgi->Vars;
+    my $params = Bugzilla->input_params;
+    my $cgi = Bugzilla->cgi;
     my ($multi, $key);
     for (keys %$params)
     {

Bugzilla/Auth/Login/CGI.pm

@@ -44,6 +44,7 @@ sub get_login_info {
 
     my $username = trim(delete $params->{"Bugzilla_login"});
     my $password = delete $params->{"Bugzilla_password"};
+    Bugzilla->cgi->delete('Bugzilla_login', 'Bugzilla_password');
 
     if (!defined $username || !defined $password) {
         return { failure => AUTH_NODATA };

Bugzilla/Bug.pm

@@ -271,7 +271,7 @@ use constant FIELD_MAP => {
 use constant SCALAR_FORMAT => { map { $_ => 1 } qw(
     alias bug_file_loc bug_id dup_id cclist_accessible creation_ts deadline
     delta_ts estimated_time everconfirmed remaining_time reporter_accessible
-    short_desc status_whiteboard keywords
+    short_desc status_whiteboard keywords votes
 ) };
 
 use constant ARRAY_FORMAT => { map { $_ => 1 } qw(dependson blocked cc) };
@@ -671,7 +671,7 @@ sub prepare_mail_results
     {
         $type = 'created';
     }
-    elsif ($self->{added_comments} && grep { $_->{type} == CMT_POPULAR_VOTES } @{$self->{added_comments}})
+    elsif ($self->{added_comments} && grep { ($_->{type} || CMT_NORMAL) == CMT_POPULAR_VOTES } @{$self->{added_comments}})
     {
         $type = 'votes';
     }
@@ -805,7 +805,7 @@ sub get_dependent_check_order
         my @a;
         while (@d)
         {
-            $f = $check{shift @d};
+            $f = $check{shift(@d)||''};
             if ($f)
             {
                 unshift @a, $f;
@@ -1087,7 +1087,7 @@ sub _check_resolution
         ThrowUserError('missing_resolution', { status => $self->status->name });
     }
 
-    if (!$self->{_old_self} && $self->resolution || $self->{_old_self} && $self->resolution != $self->{_old_self}->resolution)
+    if (!$self->{_old_self} && $self->resolution || $self->{_old_self} && ($self->resolution || 0) != ($self->{_old_self}->resolution || 0))
     {
         # Check noresolveonopenblockers.
         if (Bugzilla->params->{noresolveonopenblockers} && $self->resolution && @{$self->dependson})
@@ -1928,7 +1928,7 @@ sub _set_component
         $self->{_unknown_dependent_values}->{component} = [ $name ];
         return undef;
     }
-    if ($self->component_id != $obj->id)
+    if (($self->component_id || 0) != $obj->id)
     {
         $self->{component_id}  = $obj->id;
         $self->{component}     = $obj->name;
@@ -1966,7 +1966,7 @@ sub _set_dup_id
     my ($self, $dupe_of) = @_;
 
     $dupe_of = defined $dupe_of ? trim($dupe_of) : undef;
-    if ($dupe_of eq $self->dup_id)
+    if (($dupe_of || 0) == ($self->dup_id || 0))
     {
         return undef;
     }
@@ -2214,7 +2214,7 @@ sub _set_product
     # can_enter_product already does everything that check_product
     # would do for us, so we don't need to use it.
     my $product = new Bugzilla::Product({ name => $name });
-    if ($self->product_id != $product->id)
+    if (($self->product_id || 0) != $product->id)
     {
         $self->{product_id}  = $product->id;
         $self->{product}     = $product->name;
@@ -2429,7 +2429,7 @@ sub _set_datetime_field
 
     # Empty datetimes are empty strings or strings only containing
     # 0's, whitespace, and punctuation.
-    if ($date_time =~ /^[\s0[:punct:]]*$/)
+    if (($date_time || '') =~ /^[\s0[:punct:]]*$/)
     {
         return $self->{$field} = undef;
     }
@@ -2460,7 +2460,7 @@ sub _set_default_field
 sub _set_numeric_field
 {
     my ($self, $text, $field) = @_;
-    ($text) = $text =~ /^(-?\d+(\.\d+)?)$/so;
+    ($text) = (($text || 0) =~ /^(-?\d+(\.\d+)?)$/so);
     return $text || 0;
 }
 
@@ -2979,7 +2979,7 @@ sub dup_id
 sub deadline
 {
     my ($self) = @_;
-    my $s = $self->{deadline};
+    my $s = $self->{deadline} || '';
     $s =~ s/\s+.*//s;
     return $s eq '0000-00-00' ? '' : $s;
 }
@@ -3556,8 +3556,8 @@ sub ValidateTime
 {
     my ($time, $field) = @_;
 
-    $time =~ tr/,/./;
     $time = trim($time) || 0;
+    $time =~ tr/,/./;
 
     if ($time =~ /^(-?)(\d+):(\d+)$/so)
     {
@@ -4335,7 +4335,7 @@ sub get_string
     else
     {
         warn "Don't know how to format field in text: $f";
-        next;
+        return '';
     }
     return $value;
 }

Bugzilla/CGI.pm

@@ -435,42 +435,6 @@ sub url_is_attachment_base
     return ($self->self_url =~ $regex) ? 1 : 0;
 }
 
-##########################
-# Vars TIEHASH Interface #
-##########################
-
-# Fix the TIEHASH interface (scalar $cgi->Vars) to return and accept arrayrefs.
-sub STORE
-{
-    my $self = shift;
-    my ($param, $value) = @_;
-    if (defined $value and ref $value eq 'ARRAY')
-    {
-        return $self->param(-name => $param, -value => $value);
-    }
-    return $self->SUPER::STORE(@_);
-}
-
-sub FETCH
-{
-    my ($self, $param) = @_;
-    return $self if $param eq 'CGI'; # CGI.pm did this, so we do too.
-    my @result = $self->param($param);
-    return undef if !scalar(@result);
-    return $result[0] if scalar(@result) == 1;
-    return \@result;
-}
-
-# For the Vars TIEHASH interface: the normal CGI.pm DELETE doesn't return 
-# the value deleted, but Perl's "delete" expects that value.
-sub DELETE
-{
-    my ($self, $param) = @_;
-    my $value = $self->FETCH($param);
-    $self->delete($param);
-    return $value;
-}
-
 # cookie() with UTF-8 support...
 sub cookie
 {
@@ -532,7 +496,7 @@ sub VarHash
     my $self = shift;
     return $self->{_VarHash} if $self->{_VarHash};
     my ($force_array) = @_;
-    my $args = { %{ $self->Vars } };
+    my $args = Bugzilla->input_params;
     my $filtered = {};
     for my $key (keys %$args)
     {

Bugzilla/Error.pm

@@ -61,7 +61,7 @@ sub _error_message
     $Data::Dumper::Indent = 1;
     # Don't try to dump upload data, dump upload info instead
     my $cgi = Bugzilla->cgi;
-    my $cgivars = { $cgi->Vars };
+    my $cgivars = Bugzilla->input_params;
     for (keys %$cgivars)
     {
         $cgivars->{$_} = $cgi->uploadInfo($cgivars->{$_}) if $cgi->upload($_);

Bugzilla/Field.pm

@@ -1270,7 +1270,7 @@ sub bug_or_hash_value
     {
         # Hashref with value names
         $value = $bug->{$vf->name};
-        if (!ref $value)
+        if (!ref $value && defined $value)
         {
             # FIXME: This does not allow selecting of fields
             # non-uniquely identified by name, as a visibility

Bugzilla/User.pm

@@ -166,14 +166,6 @@ sub is_super_user
     return $self eq $SUPERUSER;
 }
 
-sub create
-{
-    my $self = shift;
-    my ($params) = @_;
-    $params->{is_enabled} = !defined $params->{disabledtext} || $params->{disabledtext} eq '';
-    $self->SUPER::create($params);
-}
-
 sub update
 {
     my $self = shift;
@@ -1283,6 +1275,7 @@ sub match {
 sub match_field {
     my $fields       = shift;   # arguments as a hash
     my $data         = shift || Bugzilla->input_params; # hash to look up fields in
+    my $cgi          = $data eq Bugzilla->input_params ? Bugzilla->cgi : undef;
     my $behavior     = shift || 0; # A constant that tells us how to act
     my $matches      = {};      # the values sent to the template
     my $matchsuccess = 1;       # did the match fail?
@@ -1334,6 +1327,7 @@ sub match_field {
                         # has been deleted (may occur in race conditions).
                         delete $expanded_fields->{$field_name};
                         delete $data->{$field_name};
+                        $cgi->delete($field_name) if $cgi;
                     }
                 }
             }
@@ -1363,12 +1357,14 @@ sub match_field {
             # We will repopulate it later if a match is found, else it must
             # be set to an empty string so that the field remains defined.
             $data->{$field} = '';
+            $cgi->param($field, '') if $cgi;
         }
         elsif ($fields->{$field}->{'type'} eq 'multi') {
             @queries =  split(/[\s,;]+/, $raw_field);
             # We will repopulate it later if a match is found, else it must
             # be undefined.
             delete $data->{$field};
+            $cgi->delete($field) if $cgi;
         }
         else {
             # bad argument
@@ -1440,9 +1436,11 @@ sub match_field {
         # field was defined or not (and it was if we came here).
         if ($fields->{$field}->{'type'} eq 'single') {
             $data->{$field} = $logins[0] || '';
+            $cgi->param($field, $logins[0] || '') if $cgi;
         }
         elsif (scalar @logins) {
             $data->{$field} = \@logins;
+            $cgi->param($field, @logins) if $cgi;
         }
     }
 
@@ -1462,8 +1460,6 @@ sub match_field {
         return wantarray ? ($retval, \@non_conclusive_fields) : $retval;
     }
 
-    my $template = Bugzilla->template;
-    my $cgi = Bugzilla->cgi;
     my $vars = {};
 
     $vars->{'script'}        = $cgi->url(-relative => 1); # for self-referencing URLs
@@ -1472,10 +1468,8 @@ sub match_field {
     $vars->{'matchsuccess'}  = $matchsuccess; # continue or fail
     $vars->{'matchmultiple'} = $match_multiple;
 
-    $cgi->send_header();
+    Bugzilla->template->process("global/confirm-user-match.html.tmpl", $vars)
-
+        || ThrowTemplateError(Bugzilla->template->error());
-    $template->process("global/confirm-user-match.html.tmpl", $vars)
-      || ThrowTemplateError($template->error());
     exit;
 }
 
@@ -1761,13 +1755,17 @@ sub get_userlist
 
 sub create
 {
-    my $invocant = shift;
+    my $class = shift;
-    my $class = ref($invocant) || $invocant;
+    $class = ref($class) || $class;
+
+    my ($params) = @_;
     my $dbh = Bugzilla->dbh;
 
+    $params->{is_enabled} = !defined $params->{disabledtext} || $params->{disabledtext} eq '';
+
     $dbh->bz_start_transaction();
 
-    my $user = $class->SUPER::create(@_);
+    my $user = $class->SUPER::create($params);
 
     # Turn on all email for the new user
     foreach my $rel (RELATIONSHIPS) {

Bugzilla/Util.pm

@@ -79,6 +79,7 @@ eval { require 'Lingua/Stem/Snowball.pm' };
 
 sub is_tainted
 {
+    no warnings;
     return !eval { join('', @_), kill 0; 1; };
 }
 
@@ -452,9 +453,9 @@ sub makeCitations
     for (split /\n/, $input)
     {
         s/^((?:\s*>)+ ?)?//s;
-        $re = ($1 =~ tr/&/&/);
         if ($_)
         {
+            $re = (($1 || '') =~ tr/&/&/);
             $text .= ("<div class=\"quote\">\n" x ($re-$last)) .
                 ("</div>\n" x ($last-$re)) . $_ . "\n";
             $last = $re;

buglist.cgi

@@ -59,7 +59,7 @@ my $cgi = Bugzilla->cgi;
 my $dbh = Bugzilla->dbh;
 my $template = Bugzilla->template;
 my $vars = {};
-my $ARGS = { %{ $cgi->Vars } };
+my $ARGS = Bugzilla->input_params;
 my $query_format = $ARGS->{query_format} || 'advanced';
 
 # We have to check the login here to get the correct footer if an error is

editcheckers.cgi

@@ -15,8 +15,7 @@ use Bugzilla::Token;
 
 my $template = Bugzilla->template;
 my $user = Bugzilla->login(LOGIN_REQUIRED);
-my $cgi = Bugzilla->cgi;
+my $params = Bugzilla->input_params;
-my $params = { %{ $cgi->Vars } };
 my $vars = {};
 
 $user->in_group('bz_editcheckers') || ThrowUserError('auth_failure', {
@@ -91,7 +90,7 @@ if ($params->{save})
     {
         Bugzilla->dbh->do('DELETE FROM checkers WHERE id=?', undef, $id);
     }
-    print $cgi->redirect(-location => 'editcheckers.cgi');
+    print Bugzilla->cgi->redirect(-location => 'editcheckers.cgi');
     exit;
 }
 

editcomponents.cgi

@@ -41,7 +41,7 @@ my $vars = {};
 # so all actions point to the same page.
 $vars->{'doc_section'} = 'components.html';
 
-my $ARGS = { %{ $cgi->Vars } };
+my $ARGS = Bugzilla->input_params;
 
 #
 # Preliminary checks:

editemailin.cgi

@@ -1,5 +1,7 @@
 #!/usr/bin/perl -wT
-# -*- Mode: perl; indent-tabs-mode: nil -*-
+# Preset field editor for incoming email
+# License: Dual-license GPL 3.0+ or MPL 1.1+
+# Author(s): Vitaliy Filippov <vitalif@mail.ru>
 
 use strict;
 use lib qw(. lib);
@@ -11,11 +13,11 @@ use Bugzilla::User;
 use Bugzilla::Util;
 use Mail::RFC822::Address qw(valid);
 
-my $cgi      = Bugzilla->cgi;
 my $dbh      = Bugzilla->dbh;
 my $user     = Bugzilla->login(LOGIN_REQUIRED);
 my $template = Bugzilla->template;
 my $userid   = $user->id;
+my $params   = Bugzilla->input_params;
 
 unless ($user->in_group('admin'))
 {
@@ -26,16 +28,6 @@ unless ($user->in_group('admin'))
     });
 }
 
-my $params = {};
-for ($cgi->param)
-{
-    if (defined $cgi->param($_))
-    {
-        $params->{$_} = $cgi->param($_);
-        trick_taint($params->{$_});
-    }
-}
-
 my $vars = {
     mode_add => $params->{add} ? 1 : 0,
     email    => $params->{email} || '',
@@ -52,7 +44,7 @@ if ($params->{do})
         {
             $dbh->do("INSERT INTO `emailin_fields` SET `address`=?, `field`=?, `value`=?",
                 undef, $e, $f, $v);
-            print $cgi->redirect(-location => "editemailin.cgi");
+            print Bugzilla->cgi->redirect(-location => "editemailin.cgi");
             exit;
         }
         else
@@ -89,7 +81,7 @@ if ($params->{do})
                 join(",", ("(?,?)") x @$del) . ")", undef, map { @$_ } @$del
             );
         }
-        print $cgi->redirect(-location => "editemailin.cgi");
+        print Bugzilla->cgi->redirect(-location => "editemailin.cgi");
         exit;
     }
 }

editmilestones.cgi

@@ -37,7 +37,7 @@ my $vars = {};
 # so all actions point to the same page.
 $vars->{'doc_section'} = 'milestones.html';
 
-my $ARGS = { %{ $cgi->Vars } };
+my $ARGS = Bugzilla->input_params;
 
 #
 # Preliminary checks:

editproducts.cgi

@@ -49,7 +49,7 @@ my $vars = {};
 # improved and each action has its own section.
 $vars->{doc_section} = 'products.html';
 
-my $ARGS = { %{ $cgi->Vars } };
+my $ARGS = Bugzilla->input_params;
 
 $user->in_group('editcomponents') ||
     scalar(@{$user->get_editable_products}) ||

editversions.cgi

@@ -41,7 +41,7 @@ my $vars = {};
 # so all actions point to the same page.
 $vars->{'doc_section'} = 'versions.html';
 
-my $ARGS = { %{ $cgi->Vars } };
+my $ARGS = Bugzilla->input_params;
 
 #
 # Preliminary checks:

editvisibility.cgi

@@ -15,7 +15,7 @@ use Bugzilla::Field;
 use Bugzilla::Field::Choice;
 use Bugzilla::Token;
 
-my $ARGS = { %{ Bugzilla->cgi->Vars } };
+my $ARGS = Bugzilla->input_params;
 my $template = Bugzilla->template;
 my $vars = {};
 

email_in.pl

@@ -89,7 +89,7 @@ sub parse_mail
     # to delivery status reports, so also check content-type.
     my $autosubmitted;
     if (lc($input_email->header('Auto-Submitted') || 'no') ne 'no' ||
-        $input_email->header('X-Auto-Response-Suppress') =~ /all/iso ||
+        ($input_email->header('X-Auto-Response-Suppress') || '') =~ /all/iso ||
         ($input_email->header('Content-Type') || '') =~ /delivery-status/iso)
     {
         debug_print("Rejecting email with Auto-Submitted = $autosubmitted");
@@ -113,8 +113,9 @@ sub parse_mail
     $fields{_subject} = $summary;
 
     # Add CC's from email Cc: header
-    $fields{newcc} = (join ', ', map { [ Email::Address->parse($_) ] -> [0] }
+    $fields{newcc} = $input_email->header('Cc');
-        split /\s*,\s*/, $input_email->header('Cc')) || undef;
+    $fields{newcc} = $fields{newcc} && (join ', ', map { [ Email::Address->parse($_) ] -> [0] }
+        split /\s*,\s*/, $fields{newcc}) || undef;
 
     my ($body, $attachments) = get_body_and_attachments($input_email);
     if (@$attachments)
@@ -128,6 +129,8 @@ sub parse_mail
     Bugzilla::Hook::process("emailin-filter_body", { body => \$body });
     my @body_lines = split(/\r?\n/s, $body);
 
+    my $fields_by_name = { map { (lc($_->description) => $_->name, lc($_->name) => $_->name) } Bugzilla->get_fields({ obsolete => 0 }) };
+
     # If there are fields specified.
     if ($body =~ /^\s*@/s)
     {
@@ -145,9 +148,9 @@ sub parse_mail
             # Otherwise, we stop parsing fields on the first blank line.
             $line = trim($line);
             last if !$line;
-            if ($line =~ /^\@(\w+)\s*(?:=|\s|$)\s*(.*)\s*/)
+            if ($line =~ /^\@\s*(.+?)\s*=\s*(.*)\s*/)
             {
-                $current_field = lc($1);
+                $current_field = $fields_by_name->{lc($1)} || lc($1);
                 $fields{$current_field} = $2;
             }
             else
@@ -202,6 +205,7 @@ sub post_bug
     my ($fields) = @_;
     debug_print('Posting a new bug...');
     my $bug;
+    $Bugzilla::Error::IN_EVAL++;
     eval
     {
         my ($retval, $non_conclusive_fields) =
@@ -216,6 +220,7 @@ sub post_bug
         }
         $bug = Bugzilla::Bug::create_or_update($fields);
     };
+    $Bugzilla::Error::IN_EVAL--;
     if (my $err = $@)
     {
         my $format = "\n\nIncoming mail format for entering bugs:\n\n\@field = value\n\@field = value\n...\n\n<Bug description...>\n";
@@ -406,6 +411,7 @@ sub die_handler
 # Use UTF-8 in Email::Reply to correctly quote the body
 my $crlf = "\x0d\x0a";
 my $CRLF = $crlf;
+undef *Email::Reply::_quote_body;
 *Email::Reply::_quote_body = sub
 {
     my ($self, $part) = @_;
@@ -500,20 +506,6 @@ unless ($user)
 
 Bugzilla->set_user($user);
 
-if ($mail_fields->{group_ids})
-{
-    my @grp = $mail_fields->{group_ids} =~ /\d+/gso;
-    if (@grp)
-    {
-        Bugzilla->dbh->do(
-            "REPLACE INTO user_group_map (user_id, group_id, isbless, grant_type)
-            VALUES ".join(", ", ("(?,?,0,0)") x scalar @grp),
-            undef, map { $user->id, $_ } @grp
-        );
-    }
-    delete $mail_fields->{group_ids};
-}
-
 my ($bug, $comment);
 if ($mail_fields->{bug_id})
 {

extensions/Example/Extension.pm

@@ -472,7 +472,7 @@ sub page_before_template {
     
     # You can see this hook in action by loading page.cgi?id=example.html
     if ($page eq 'example.html') {
-        $vars->{cgi_variables} = { Bugzilla->cgi->Vars };
+        $vars->{cgi_variables} = Bugzilla->input_params;
     }
 }
 

extensions/Example/code/page-before_template.pl

@@ -29,5 +29,5 @@ my ($vars, $page) = @args{qw(vars page_id)};
 
 # You can see this hook in action by loading page.cgi?id=example.html
 if ($page eq 'example.html') {
-    $vars->{cgi_variables} = { Bugzilla->cgi->Vars };
+    $vars->{cgi_variables} = Bugzilla->input_params;
 }

fieldvaluecontrol.cgi

@@ -13,7 +13,7 @@ use Bugzilla;
 use Bugzilla::Util;
 use Bugzilla::Constants;
 
-my $args = { %{ Bugzilla->cgi->Vars } };
+my $args = Bugzilla->input_params;
 my $user = Bugzilla->login(~LOGIN_REQUIRED);
 
 my $ctype = 'text/javascript'.(Bugzilla->params->{utf8} ? '; charset=utf-8' : '');

fill-day-worktime.cgi

@@ -23,7 +23,7 @@ my $userid   = $user->id;
 my $template = Bugzilla->template;
 my $dbh      = Bugzilla->dbh;
 my $vars     = {};
-my $ARGS     = { %{ Bugzilla->cgi->Vars } };
+my $ARGS     = Bugzilla->input_params;
 
 my ($lastdays) = $ARGS->{lastdays} =~ /^(\d+)$/;
 $vars->{lastdays} = $lastdays ||= '1';

globalauth.cgi

@@ -20,8 +20,7 @@ use JSON;
 
 my $gc_prob = 0.01;
 
-my $cgi  = Bugzilla->cgi;
+my $args = Bugzilla->input_params;
-my $args = { %{ $cgi->Vars } };
 my $check = $args->{ga_check} ? 1 : 0; # если 1 и пользователь не вошёл, входа не требовать
 
 # требуем входа, если пришёл пользователь (в запросе нет ключа) и в запросе не сказано "не требовать входа"
@@ -45,7 +44,7 @@ if (($id = $args->{ga_id}) && !$args->{ga_client})
     {
         trick_taint($key);
         $dbh->do("REPLACE INTO globalauth SET id=?, secret=?, expire=?", undef, $id, $key, time+$expire);
-        $cgi->send_header;
+        Bugzilla->cgi->send_header;
         print "1"; # потенциально здесь любой JSON
         exit;
     }
@@ -66,7 +65,7 @@ if (($id = $args->{ga_id}) && !$args->{ga_client})
             if (!$url)
             {
                 # ошибко :(
-                $cgi->send_header;
+                Bugzilla->cgi->send_header;
                 print "Global Auth: No ga_url in request for ID=$id";
                 warn "Global Auth: No ga_url in request for ID=$id";
                 exit;
@@ -125,7 +124,7 @@ if (($id = $args->{ga_id}) && !$args->{ga_client})
                 $url->query_param(ga_res => $res->code);
             }
             $dbh->do("DELETE FROM globalauth WHERE id=?", undef, $id);
-            print $cgi->redirect(-location => "$url");
+            print Bugzilla->cgi->redirect(-location => "$url");
             exit;
         }
         else

importxls.cgi

@@ -28,11 +28,10 @@ use constant BUG_DAYS => 92;
 use constant XLS_LISTNAME => '';
 
 my $user = Bugzilla->login(LOGIN_REQUIRED);
-my $cgi = Bugzilla->cgi;
 my $dbh = Bugzilla->dbh;
 my $template = Bugzilla->template;
 my $vars = {};
-my $ARGS = { %{ $cgi->Vars } };
+my $ARGS = Bugzilla->input_params;
 
 # Check permissions
 $user->in_group('importxls') ||
@@ -232,7 +231,7 @@ else
         # Send bugmail only after successful completion
         Bugzilla->send_mail;
         Bugzilla->dbh->bz_commit_transaction;
-        print $cgi->redirect(-location => 'importxls.cgi?'.http_build_query({
+        print Bugzilla->cgi->redirect(-location => 'importxls.cgi?'.http_build_query({
             result   => $r,
             bug_id   => $ids,
             listname => $listname,

post_bug.cgi

@@ -208,8 +208,7 @@ for (keys %$ARGS)
 
 if ($is_multiple)
 {
-    my $send_attrs = {};
+    Bugzilla::Attachment::add_multiple($bug);
-    Bugzilla::Attachment::add_multiple($bug, $cgi, $send_attrs);
 }
 elsif (defined($cgi->upload('data')) || $ARGS->{attachurl} ||
     $ARGS->{text_attachment} || $ARGS->{base64_content})

process_bug.cgi

@@ -70,7 +70,7 @@ my $cgi = Bugzilla->cgi;
 my $dbh = Bugzilla->dbh;
 my $template = Bugzilla->template;
 my $vars = {};
-my $ARGS = { %{ $cgi->Vars } };
+my $ARGS = Bugzilla->input_params;
 #my $ARGS = $cgi->VarHash; # FIXME (see lines with "FIXME array[]")
 
 ######################################################################
@@ -637,7 +637,7 @@ foreach my $bug (@bug_objects)
 # CustIS Bug 68919 - Create multiple attachments to bug
 if (@bug_objects == 1)
 {
-    Bugzilla::Attachment::add_multiple($first_bug, $cgi);
+    Bugzilla::Attachment::add_multiple($first_bug);
 }
 
 $dbh->bz_commit_transaction();

query.cgi

@@ -42,8 +42,7 @@ use Bugzilla::Field;
 use Bugzilla::Install::Util qw(vers_cmp);
 
 my $cgi = Bugzilla->cgi;
-# Copy hash and throw away tied reference returned by Vars()
+my $params = Bugzilla->input_params;
-my $params = { %{ $cgi->Vars } };
 my $dbh = Bugzilla->dbh;
 my $template = Bugzilla->template;
 my $vars = {};

report.cgi

@@ -187,7 +187,7 @@ push @axis_fields, $measures->{$measure} unless $a{$measures->{$measure}};
 # Clone the params, so that Bugzilla::Search can modify them
 my $search = new Bugzilla::Search(
     'fields' => \@axis_fields,
-    'params' => { %{ $cgi->Vars } },
+    'params' => { %{ Bugzilla->input_params } },
 );
 my $query = $search->getSQL();
 $query =

rss-comments.cgi

@@ -22,7 +22,7 @@ my $vars      = {};
 
 my $template  = Bugzilla->template;
 my $dbh       = Bugzilla->dbh;
-my $ARGS      = { %{ Bugzilla->cgi->Vars } };
+my $ARGS      = Bugzilla->input_params;
 
 $vars->{buginfo} = $ARGS->{buginfo};
 

scrum.cgi

@@ -9,9 +9,8 @@ use Bugzilla::Util qw(trim html_quote);
 use Scalar::Util qw(blessed);
 use Bugzilla::Error;
 
-my $cgi = Bugzilla->cgi;
 my $user = Bugzilla->login;
-my $args = { %{ $cgi->Vars } };
+my $args = Bugzilla->input_params;
 my $vars = {};
 
 # Default $Layout settings

xml.cgi

@@ -15,9 +15,7 @@ use Bugzilla::Constants;
 use Bugzilla::Util;
 use Bugzilla::WebService::Server::XMLSimple;
 
-my $cgi = Bugzilla->cgi;
+my $args = Bugzilla->input_params;
-
-my $args = { %{ $cgi->Vars } }; # throw away the tied hash
 my $method = $args->{method};
 
 sub addmsg
@@ -42,13 +40,13 @@ if (!$method)
     # Convert comma/space separated elements into separate params
     my @ids = ();
 
-    if (defined $cgi->param('id')) {
+    if (defined $args->{id}) {
-        @ids = split (/[, ]+/, $cgi->param('id'));
+        @ids = ref $args->{id} ? @{$args->{id}} : split(/[, ]+/, $args->{id});
     }
 
     my $ids = join('', map { $_ = "&id=" . $_ } @ids);
 
-    print $cgi->redirect("show_bug.cgi?ctype=xml$ids");
+    print Bugzilla->cgi->redirect("show_bug.cgi?ctype=xml$ids");
 }
 else
 {