From bd238cf67573d5911009627098ae312f8371de2c Mon Sep 17 00:00:00 2001
From: "bzrmirror%bugzilla.org"
 <bzrmirror%bugzilla.org@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Tue, 25 Feb 2014 21:45:48 +0000
Subject: [PATCH] Bug 962060 - User.get ignores the "maxusermatches" parameter
 and allows listing all email addresses r=LpSolit,a=justdave

git-svn-id: svn://10.0.0.236/trunk@265254 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/webtools/bugzilla/.bzrrev             |  2 +-
 .../bugzilla/Bugzilla/WebService/User.pm      | 28 +++++++++++++++----
 2 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/mozilla/webtools/bugzilla/.bzrrev b/mozilla/webtools/bugzilla/.bzrrev
index 2f1701171ff..e7f635ab188 100644
--- a/mozilla/webtools/bugzilla/.bzrrev
+++ b/mozilla/webtools/bugzilla/.bzrrev
@@ -1 +1 @@
-8929
\ No newline at end of file
+8930
\ No newline at end of file
diff --git a/mozilla/webtools/bugzilla/Bugzilla/WebService/User.pm b/mozilla/webtools/bugzilla/Bugzilla/WebService/User.pm
index c440d135d5a..f3012ebc5ed 100644
--- a/mozilla/webtools/bugzilla/Bugzilla/WebService/User.pm
+++ b/mozilla/webtools/bugzilla/Bugzilla/WebService/User.pm
@@ -16,10 +16,10 @@ use Bugzilla::Constants;
 use Bugzilla::Error;
 use Bugzilla::Group;
 use Bugzilla::User;
-use Bugzilla::Util qw(trim);
+use Bugzilla::Util qw(trim detaint_natural);
 use Bugzilla::WebService::Util qw(filter filter_wants validate translate params_to_objects);
 
-use List::Util qw(first);
+use List::Util qw(first min);
 
 # Don't need auth to login
 use constant LOGIN_EXEMPT => {
@@ -209,12 +209,17 @@ sub get {
                                             userid => $obj->id});
         }
     }
-    
+
     # User Matching
-    my $limit;
-    if ($params->{'maxusermatches'}) {
-        $limit = $params->{'maxusermatches'} + 1;
+    my $limit = Bugzilla->params->{maxusermatches};
+    if ($params->{limit}) {
+        detaint_natural($params->{limit})
+            || ThrowCodeError('param_must_be_numeric',
+                              { function => 'Bugzilla::WebService::User::match',
+                                param    => 'limit' });
+        $limit = $limit ? min($params->{limit}, $limit) : $params->{limit};
     }
+
     my $exclude_disabled = $params->{'include_disabled'} ? 0 : 1;
     foreach my $match_string (@{ $params->{'match'} || [] }) {
         my $matched = Bugzilla::User::match($match_string, $limit, $exclude_disabled);
@@ -865,6 +870,13 @@ if they try. (This is to make it harder for spammers to harvest email
 addresses from Bugzilla, and also to enforce the user visibility
 restrictions that are implemented on some Bugzillas.)
 
+=item C<limit> (int)
+
+Limit the number of users matched by the C<match> parameter. If value
+is greater than the system limit, the system limit will be used. This
+parameter is only used when user matching using the C<match> parameter
+is being performed.
+
 =item C<group_ids> (array)
 
 =item C<groups> (array)
@@ -1009,6 +1021,10 @@ querying your own account, even if you are in the editusers group.
 You passed an invalid login name in the "names" array or a bad
 group ID in the C<group_ids> argument.
 
+=item 52 (Invalid Parameter)
+
+The value used must be an integer greater than zero.
+
 =item 304 (Authorization Required)
 
 You are logged in, but you are not authorized to see one of the users you