diff options
| author |   lpsolit%gmail.com <> | 2005-12-12 11:12:25 +0000 |
|---|---|---|
| committer | lpsolit%gmail.com <> | 2005-12-12 11:12:25 +0000 |
| commit | e2f691c9eb53c6a9c8b02b740b444e6d558e35e8 (patch) | |
| tree | 4b6c4e4809ae76a0d15d5242ac9943038ce1ff1e /editversions.cgi | |
| parent | Bug 319241: Bugzilla.pm is freely accessible from the web - Patch by Frédér... (diff) | |
| download | bugzilla-e2f691c9eb53c6a9c8b02b740b444e6d558e35e8.tar.gz bugzilla-e2f691c9eb53c6a9c8b02b740b444e6d558e35e8.tar.bz2 bugzilla-e2f691c9eb53c6a9c8b02b740b444e6d558e35e8.zip | |
Bug 271596: editcomponents priv allows you to see/edit products you don't have access to - Patch by Frédéric Buclin <LpSolit@gmail.com> r=wicked a=justdave
Diffstat (limited to 'editversions.cgi')
| -rwxr-xr-x | editversions.cgi | 16 |
1 files changed, 9 insertions, 7 deletions
diff --git a/editversions.cgi b/editversions.cgi index eae1001ca..be2c8a3c6 100755 --- a/editversions.cgi +++ b/editversions.cgi @@ -69,20 +69,22 @@ my $showbugcounts = (defined $cgi->param('showbugcounts')); # unless ($product_name) { - - my @products = Bugzilla::Product::get_all_products(); - + $vars->{'products'} = $user->get_selectable_products; $vars->{'showbugcounts'} = $showbugcounts; - $vars->{'products'} = \@products; - $template->process("admin/versions/select-product.html.tmpl", - $vars) - || ThrowTemplateError($template->error()); + $template->process("admin/versions/select-product.html.tmpl", $vars) + || ThrowTemplateError($template->error()); exit; } +# First make sure the product name is valid. my $product = Bugzilla::Product::check_product($product_name); +# Then make sure the user is allowed to edit properties of this product. +$user->can_see_product($product->name) + || ThrowUserError('product_access_denied', {product => $product->name}); + + # # action='' -> Show nice list of versions # |