Bug 460379: New user accounts could access editusers and add and remove themselves...

Patch By Max Kanat-Alexander <mkanat@bugzilla.org> r=LpSolit, a=LpSolit

diff --git a/Bugzilla/User.pm b/Bugzilla/User.pm
index aa3baa24380fd1bf1c78b6fdbe59f3e98ec3d814..293b18d3e5b2af9d12d2cbbf2863159b999c7a31 100644 (file)
--- a/Bugzilla/User.pm
+++ b/Bugzilla/User.pm
@@ -453,7 +453,8 @@ sub bless_groups {
     # Get all groups for the user where:
     #    + They have direct bless privileges
     #    + They are a member of a group that inherits bless privs.
-    my @group_ids = (map {$_->id} @{ $self->groups }) || (-1);
+    my @group_ids = map {$_->id} @{ $self->groups };
+    @group_ids = (-1) if !@group_ids;
     my $query =
         'SELECT DISTINCT groups.id
            FROM groups, user_group_map, group_group_map AS ggm