diff options
author | 2014-10-08 13:02:24 +1000 | |
---|---|---|
committer | 2014-10-08 13:02:24 +1000 | |
commit | 8e3d2def0677012b004b645e74638aaea4507104 (patch) | |
tree | ace2eef70960d9afc8e1d4765b87cd1bc79e751a | |
parent | Bump version post-release (diff) | |
download | bugzilla-8e3d2def0677012b004b645e74638aaea4507104.tar.gz bugzilla-8e3d2def0677012b004b645e74638aaea4507104.tar.bz2 bugzilla-8e3d2def0677012b004b645e74638aaea4507104.zip |
Bug 1009406 - A user with local editcomponents privs cannot update the inclusion and exclusion lists when the flagtype is already restricted to products the user cannot edit
r=dkl, a=simon
-rw-r--r-- | Bugzilla/FlagType.pm | 19 |
1 files changed, 17 insertions, 2 deletions
diff --git a/Bugzilla/FlagType.pm b/Bugzilla/FlagType.pm index 9c20293bf..9e7ab09de 100644 --- a/Bugzilla/FlagType.pm +++ b/Bugzilla/FlagType.pm @@ -39,6 +39,7 @@ use Bugzilla::Util; use Bugzilla::Group; use Email::Address; +use List::MoreUtils qw(uniq); use base qw(Bugzilla::Object); @@ -369,8 +370,6 @@ sub set_clusions { if (!$products{$prod_id}) { $params->{id} = $prod_id; $products{$prod_id} = Bugzilla::Product->check($params); - $user->in_group('editcomponents', $prod_id) - || ThrowUserError('product_access_denied', $params); } $prod_name = $products{$prod_id}->name; @@ -396,6 +395,22 @@ sub set_clusions { $clusions{"$prod_name:$comp_name"} = "$prod_id:$comp_id"; $clusions_as_hash{$prod_id}->{$comp_id} = 1; } + + # Check the user has the editcomponent permission on products that are changing + if (! $user->in_group('editcomponents')) { + my $current_clusions = $self->$category; + my ($removed, $added) + = diff_arrays([ values %$current_clusions ], [ values %clusions ]); + my @changed_product_ids + = uniq map { substr($_, 0, index($_, ':')) } @$removed, @$added; + foreach my $product_id (@changed_product_ids) { + $user->in_group('editcomponents', $product_id) + || ThrowUserError('product_access_denied', + { name => $products{$product_id}->name }); + } + } + + # Set the changes $self->{$category} = \%clusions; $self->{"${category}_as_hash"} = \%clusions_as_hash; $self->{"_update_$category"} = 1; |