Bug 234825: Keep duplicates.cgi from revealing products user doesnt have access to

r,a=justdave

diff --git a/duplicates.cgi b/duplicates.cgi
index b45bd27106261169e8214ffd522e7d18f358988f..744ad814730f2305edb1c59114536915e61d57f7 100755 (executable)
--- a/duplicates.cgi
+++ b/duplicates.cgi
@@ -266,7 +266,8 @@ $vars->{'openonly'} = $openonly;
 $vars->{'reverse'} = $reverse;
 $vars->{'format'} = $cgi->param('format');
 $vars->{'query_products'} = \@query_products;
-$vars->{'products'} = \@::legal_product;
+my @selectable_products = GetSelectableProducts();
+$vars->{'products'} = \@selectable_products;
 
 
 my $format = GetFormat("reports/duplicates", scalar($cgi->param('format')),