Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 864625 - Setting a non-privileged user as a requestee on a secure bug while ccing the same user to give access at the same

Browse Source 
r=LpSolit,a=sgreen


git-svn-id: svn://10.0.0.236/trunk@265045 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
bzrmirror%bugzilla.org
2013-09-30 04:04:04 +00:00
parent 1e7515d129
commit f1da4a437d
2 changed files with 15 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
mozilla/webtools/bugzilla/.bzrrev
View File

@@ -1 +1 @@
8766
8767

20
mozilla/webtools/bugzilla/Bugzilla/Flag.pm
View File

@@ -397,7 +397,7 @@ sub _validate {
my $old_requestee_id = $obj_flag->requestee_id;
$obj_flag->_set_status($params->{status});
$obj_flag->_set_requestee($params->{requestee}, $attachment, $params->{skip_roe});
$obj_flag->_set_requestee($params->{requestee}, $bug, $attachment, $params->{skip_roe});
# The requestee ID can be undefined.
my $requestee_changed = ($obj_flag->requestee_id || 0) != ($old_requestee_id || 0);
@@ -623,10 +623,10 @@ sub force_retarget {
###############################
sub _set_requestee {
my ($self, $requestee, $attachment, $skip_requestee_on_error) = @_;
my ($self, $requestee, $bug, $attachment, $skip_requestee_on_error) = @_;
$self->{requestee} =
$self->_check_requestee($requestee, $attachment, $skip_requestee_on_error);
$self->_check_requestee($requestee, $bug, $attachment, $skip_requestee_on_error);
$self->{requestee_id} =
$self->{requestee} ? $self->{requestee}->id : undef;
@@ -648,7 +648,7 @@ sub _set_status {
}
sub _check_requestee {
my ($self, $requestee, $attachment, $skip_requestee_on_error) = @_;
my ($self, $requestee, $bug, $attachment, $skip_requestee_on_error) = @_;
# If the flag status is not "?", then no requestee can be defined.
return undef if ($self->status ne '?');
@@ -680,8 +680,16 @@ sub _check_requestee {
# Note that can_see_bug() will query the DB, so if the bug
# is being added/removed from some groups and these changes
# haven't been committed to the DB yet, they won't be taken
# into account here. In this case, old restrictions matters.
if (!$requestee->can_see_bug($self->bug_id)) {
# into account here. In this case, old group restrictions matter.
# However, if the user has just been changed to the assignee,
# qa_contact, or added to the cc list of the bug and the bug
# is cclist_accessible, the requestee is allowed.
if (!$requestee->can_see_bug($self->bug_id)
&& (!$bug->cclist_accessible
|| !grep($_->id == $requestee->id, @{ $bug->cc_users })
&& $requestee->id != $bug->assigned_to->id
&& (!$bug->qa_contact || $requestee->id != $bug->qa_contact->id)))
{
if ($skip_requestee_on_error) {
undef $requestee;
}