Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 337026: Users with no privs cannot edit bugs anymore (if being logged out first) - Patch by Frédéric Buclin <LpSolit@gmail.com> r/a=justdave

Browse Source 
git-svn-id: svn://10.0.0.236/trunk@196146 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
lpsolit%gmail.com
2006-05-08 00:18:55 +00:00
parent 07574d0c8b
commit df36b0ed2d
1 changed files with 23 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
mozilla/webtools/bugzilla/process_bug.cgi
View File

@@ -838,6 +838,26 @@ sub ChangeResolution {
if (!$cgi->param('dontchange')
|| $str ne $cgi->param('dontchange'))
{
# Make sure the user is allowed to change the resolution.
# If the user is changing several bugs at once using the UI,
# then he has enough privs to do so. In the case he is hacking
# the URL, we don't care if he reads --UNKNOWN-- as a resolution
# in the error message.
my $old_resolution = '-- UNKNOWN --';
my $bug_id = $cgi->param('id');
if ($bug_id) {
$old_resolution =
$dbh->selectrow_array('SELECT resolution FROM bugs WHERE bug_id = ?',
undef, $bug_id);
}
unless (CheckCanChangeField('resolution', $bug_id, $old_resolution, $str)) {
$vars->{'oldvalue'} = $old_resolution;
$vars->{'newvalue'} = $str;
$vars->{'field'} = 'resolution';
$vars->{'privs'} = $PrivilegesRequired;
ThrowUserError("illegal_change", $vars);
}
DoComma();
$::query .= "resolution = ?";
trick_taint($str);
@@ -1539,6 +1559,9 @@ foreach my $id (@idlist) {
}
}
foreach my $col (@::log_columns) {
# The 'resolution' field is checked by ChangeResolution(),
# i.e. only if we effectively use it.
next if ($col eq 'resolution');
if (exists $formhash{$col}
&& !CheckCanChangeField($col, $id, $oldhash{$col}, $formhash{$col}))
{