From 1ae47c24bddc6ac08c6ecc6b81cec08f0cd2213e Mon Sep 17 00:00:00 2001 From: "mkanat%bugzilla.org" Date: Thu, 19 Nov 2009 02:09:45 +0000 Subject: [PATCH] Bug 529416: (CVE-2009-3386) [SECURITY] Dependency lists display bug aliases even for bugs the user cannot access Patch by Dave Miller r=LpSolit, r=mkanat, a=mkanat git-svn-id: svn://10.0.0.236/trunk@259032 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/webtools/bugzilla/Bugzilla/Template.pm | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/mozilla/webtools/bugzilla/Bugzilla/Template.pm b/mozilla/webtools/bugzilla/Bugzilla/Template.pm index ba0a035bbe6..17429a2e2ee 100644 --- a/mozilla/webtools/bugzilla/Bugzilla/Template.pm +++ b/mozilla/webtools/bugzilla/Bugzilla/Template.pm @@ -348,10 +348,6 @@ sub get_bug_link { $bug = blessed($bug) ? $bug : new Bugzilla::Bug($bug); return $link_text if $bug->{error}; - if ($options->{use_alias} && $link_text =~ /^\d+$/ && $bug->alias) { - $link_text = $bug->alias; - } - # Initialize these variables to be "" so that we don't get warnings # if we don't change them below (which is highly likely). my ($pre, $title, $post) = ("", "", ""); @@ -369,6 +365,9 @@ sub get_bug_link { } if (Bugzilla->user->can_see_bug($bug)) { $title .= " - " . $bug->short_desc; + if ($options->{use_alias} && $link_text =~ /^\d+$/ && $bug->alias) { + $link_text = $bug->alias; + } } # Prevent code injection in the title. $title = html_quote(clean_text($title));