Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 495257: [SECURITY] Make check_can_change_field enforce permissions on confirming a bug and on which bug statuses a user can set

Browse Source 
Patch by Max Kanat-Alexander <mkanat@bugzilla.org> r=LpSolit, a=mkanat


git-svn-id: svn://10.0.0.236/trunk@257663 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
mkanat%bugzilla.org
2009-07-08 13:56:51 +00:00
parent 582baa8c4b
commit d7e81ffaf7
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
mozilla/webtools/bugzilla/Bugzilla/Bug.pm
View File

@@ -168,6 +168,7 @@ use constant UPDATE_VALIDATORS => {
bug_status => \&_check_bug_status,
cclist_accessible => \&Bugzilla::Object::check_boolean,
dup_id => \&_check_dup_id,
everconfirmed => \&Bugzilla::Object::check_boolean,
qa_contact => \&_check_qa_contact,
reporter_accessible => \&Bugzilla::Object::check_boolean,
resolution => \&_check_resolution,
@@ -3461,6 +3462,7 @@ sub check_can_change_field {
# *Only* users with (product-specific) "canconfirm" privs can confirm bugs.
if ($field eq 'canconfirm'
|| ($field eq 'everconfirmed' && $newvalue)
|| ($field eq 'bug_status'
&& $oldvalue eq 'UNCONFIRMED'
&& is_open_state($newvalue)))
@@ -3516,6 +3518,18 @@ sub check_can_change_field {
$$PrivilegesRequired = 2;
return 0;
}
# - unconfirm bugs (confirming them is handled above)
if ($field eq 'everconfirmed') {
$$PrivilegesRequired = 2;
return 0;
}
# - change the status from one open state to another
if ($field eq 'bug_status'
&& is_open_state($oldvalue) && is_open_state($newvalue))
{
$$PrivilegesRequired = 2;
return 0;
}
# The reporter is allowed to change anything else.
if (!$self->{'error'} && $self->{'reporter_id'} == $user->id) {