From df36b0ed2d3c671c245e352fa024a279bdd946aa Mon Sep 17 00:00:00 2001
From: "lpsolit%gmail.com"
 <lpsolit%gmail.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Mon, 8 May 2006 00:18:55 +0000
Subject: [PATCH] =?UTF-8?q?Bug=20337026:=20Users=20with=20no=20privs=20can?=
 =?UTF-8?q?not=20edit=20bugs=20anymore=20(if=20being=20logged=20out=20firs?=
 =?UTF-8?q?t)=20-=20Patch=20by=20Fr=C3=A9d=C3=A9ric=20Buclin=20<LpSolit@gm?=
 =?UTF-8?q?ail.com>=20r/a=3Djustdave?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

git-svn-id: svn://10.0.0.236/trunk@196146 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/webtools/bugzilla/process_bug.cgi | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/mozilla/webtools/bugzilla/process_bug.cgi b/mozilla/webtools/bugzilla/process_bug.cgi
index 9ef459bec0d..8e93e3f09ed 100755
--- a/mozilla/webtools/bugzilla/process_bug.cgi
+++ b/mozilla/webtools/bugzilla/process_bug.cgi
@@ -838,6 +838,26 @@ sub ChangeResolution {
     if (!$cgi->param('dontchange')
         || $str ne $cgi->param('dontchange'))
     {
+        # Make sure the user is allowed to change the resolution.
+        # If the user is changing several bugs at once using the UI,
+        # then he has enough privs to do so. In the case he is hacking
+        # the URL, we don't care if he reads --UNKNOWN-- as a resolution
+        # in the error message.
+        my $old_resolution = '-- UNKNOWN --';
+        my $bug_id = $cgi->param('id');
+        if ($bug_id) {
+            $old_resolution =
+                $dbh->selectrow_array('SELECT resolution FROM bugs WHERE bug_id = ?',
+                                       undef, $bug_id);
+        }
+        unless (CheckCanChangeField('resolution', $bug_id, $old_resolution, $str)) {
+            $vars->{'oldvalue'} = $old_resolution;
+            $vars->{'newvalue'} = $str;
+            $vars->{'field'} = 'resolution';
+            $vars->{'privs'} = $PrivilegesRequired;
+            ThrowUserError("illegal_change", $vars);
+        }
+
         DoComma();
         $::query .= "resolution = ?";
         trick_taint($str);
@@ -1539,6 +1559,9 @@ foreach my $id (@idlist) {
         }
     }
     foreach my $col (@::log_columns) {
+        # The 'resolution' field is checked by ChangeResolution(),
+        # i.e. only if we effectively use it.
+        next if ($col eq 'resolution');
         if (exists $formhash{$col}
             && !CheckCanChangeField($col, $id, $oldhash{$col}, $formhash{$col}))
         {