Bommels05/Mozilla
Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 385209: Any (powerless) user who can see a restricted bug can remove the bug from non-mandatory groups, which should only be possible when moving the bug to another product - Patch by Frédéric Buclin <LpSolit@gmail.com> r=mkanat a=LpSolit

Browse Source 
git-svn-id: svn://10.0.0.236/trunk@228425 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
lpsolit%gmail.com 2007-06-21 14:06:05 +00:00
parent dc21b3e759
commit 7460f8823a
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
mozilla/webtools/bugzilla/process_bug.cgi
View File

@ -227,6 +227,7 @@ if ($cgi->cookie("BUGLIST") && defined $cgi->param('id')) {
defined($cgi->param('product'))
|| ThrowCodeError('undefined_field', { field => 'product' });
my $product_change = 0;
if ((defined $cgi->param('id') && $cgi->param('product') ne $bug->product)
|| (!$cgi->param('id')
&& $cgi->param('product') ne $cgi->param('dontchange')))
@ -371,6 +372,7 @@ if ((defined $cgi->param('id') && $cgi->param('product') ne $bug->product)
|| ThrowTemplateError($template->error());
exit;
}
$product_change = 1;
}
# At this point, the component must be defined, even if set to "dontchange".
@ -1387,7 +1389,12 @@ foreach my $id (@idlist) {
}
# When editing several bugs at once, only consider groups which
# have been displayed.
elsif (defined $cgi->param('id') || defined $cgi->param("bit-$gid")) {
# Only members of a group can add/remove the bug to/from it,
# unless the bug is being moved to another product in which case
# non-members can also edit group restrictions.
elsif (($user->in_group_id($gid) || $product_change)
&& (defined $cgi->param('id') || defined $cgi->param("bit-$gid")))
{
if (!$cgi->param("bit-$gid")) {
delete $updated_groups{$gid};
}