Bug 234825: Prevent duplicates.cgi from revealing products user doesnt have access to

r=justdave
a=justdave

diff --git a/duplicates.cgi b/duplicates.cgi
index 7172fa6f9974cdf4aba01f182baaa4454de08408..f4b5d9f977ac84ecd62fc6d059578a567939f2cb 100755 (executable)
--- a/duplicates.cgi
+++ b/duplicates.cgi
@@ -205,7 +205,10 @@ $vars->{'openonly'} = $openonly;
 $vars->{'reverse'} = $reverse;
 $vars->{'format'} = $::FORM{'format'};
 $vars->{'product'} = $product;
-$vars->{'products'} = \@::legal_product;
+my @entry_products = grep {(!Param("usebuggroups") 
+                         || !GroupExists($_) 
+                         || UserInGroup($_))} @::legal_product;
+$vars->{'products'} = \@entry_products;
 
 
 my $format = ValidateOutputFormat($::FORM{'format'}, "duplicates", "reports");