From 23b8eb83965abf6b1da19c3f579b754c43e94748 Mon Sep 17 00:00:00 2001 From: "justdave%bugzilla.org" Date: Mon, 25 Oct 2004 07:37:01 +0000 Subject: [PATCH] [SECURITY] Bug 250605: Changes to the metadata (filename, description, mime type, review flags) on attachments which were flagged as private get displayed to users who are not members of the group allowed to see private attachments when receiving bug change notification mails. This only affects sites that use the 'insidergroup' feature. Patch by Joel Peshkin r=kiko,justdave, a=justdave git-svn-id: svn://10.0.0.236/trunk@164339 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/webtools/bugzilla/Bugzilla/BugMail.pm | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/mozilla/webtools/bugzilla/Bugzilla/BugMail.pm b/mozilla/webtools/bugzilla/Bugzilla/BugMail.pm index 2526ffada87..22f97d365c1 100644 --- a/mozilla/webtools/bugzilla/Bugzilla/BugMail.pm +++ b/mozilla/webtools/bugzilla/Bugzilla/BugMail.pm @@ -238,6 +238,11 @@ sub ProcessOneBug($) { $old = FormatTimeUnit($old); $new = FormatTimeUnit($new); } + if ($attachid) { + SendSQL("SELECT isprivate FROM attachments + WHERE attach_id = $attachid"); + $diffpart->{'isprivate'} = FetchOneColumn(); + } $difftext = FormatTriple($what, $old, $new); $diffpart->{'header'} = $diffheader; $diffpart->{'fieldname'} = $fieldname; @@ -772,6 +777,11 @@ sub NewProcessOnePerson ($$$$$$$$$$$$$) { if ($user->groups->{Param("timetrackinggroup")}) { $add_diff = 1; } + } elsif (($diff->{'isprivate'}) + && Param('insidergroup') + && !($user->groups->{Param('insidergroup')}) + ) { + $add_diff = 0; } else { $add_diff = 1; }