Bug 141593 You can add/remove dependencies on bugs you can't see

Patch by Joel Peshkin <bugreport@peshkin.net>
r=lpsolit, a=justdave

diff --git a/post_bug.cgi b/post_bug.cgi
index 84c74bddd5f604cf2667cd39205dfba34036b683..9d92c3c98955beb74b4365a3769db8c7b51d66fe 100755 (executable)
--- a/post_bug.cgi
+++ b/post_bug.cgi
@@ -264,7 +264,9 @@ foreach my $field ("dependson", "blocked") {
         my @validvalues;
         foreach my $id (split(/[\s,]+/, $cgi->param($field))) {
             next unless $id;
-            ValidateBugID($id, $field);
+            # $field is not passed to ValidateBugID to prevent adding new 
+            # dependencies on inacessible bugs.
+            ValidateBugID($id);
             push(@validvalues, $id);
         }
         $cgi->param(-name => $field, -value => join(",", @validvalues));

diff --git a/process_bug.cgi b/process_bug.cgi
index cf10e0c6ffd086f40ddf11e4a915c151bf3cc903..a7c0e6754453a8cf8795cab7fedbbf79b7ba0c71 100755 (executable)
--- a/process_bug.cgi
+++ b/process_bug.cgi
@@ -43,6 +43,7 @@ use strict;
 my $UserInEditGroupSet = -1;
 my $UserInCanConfirmGroupSet = -1;
 my $PrivilegesRequired = 0;
+my $lastbugid = 0;
 
 use lib qw(.);
 
@@ -142,14 +143,32 @@ ValidateComment(scalar $cgi->param('comment'));
 # is a bug alias that gets converted to its corresponding bug ID
 # during validation.
 foreach my $field ("dependson", "blocked") {
-    if ($cgi->param($field)) {
-        my @validvalues;
+    if ($cgi->param('id')) {
+        my $bug = new Bugzilla::Bug($cgi->param('id'), $user->id);
+        my @old = @{$bug->$field};
+        my @new;
         foreach my $id (split(/[\s,]+/, $cgi->param($field))) {
             next unless $id;
             ValidateBugID($id, $field);
-            push(@validvalues, $id);
+            push @new, $id;
+        }
+        $cgi->param($field, join(",", @new));
+        my ($added, $removed) = Bugzilla::Util::diff_arrays(\@old, \@new);
+        foreach my $id (@$added , @$removed) {
+            # ValidateBugID is called without $field here so that it will
+            # throw an error if any of the changed bugs are not visible.
+            ValidateBugID($id);
+            if (!CheckCanChangeField($field, $bug->bug_id, 0, 1)) {
+                $vars->{'privs'} = $PrivilegesRequired;
+                $vars->{'field'} = $field;
+                ThrowUserError("illegal_change", $vars);
+            }
         }
-        $cgi->param($field, join(",", @validvalues));
+    } else {
+        # Bugzilla does not support mass-change of dependencies so they
+        # are not validated.  To prevent a URL-hacking risk, the dependencies
+        # are deleted for mass-changes.
+        $cgi->delete($field);
     }
 }
 
@@ -361,7 +380,6 @@ if (((defined $cgi->param('id') && $cgi->param('product') ne $oldproduct)
 # now, the rules are pretty simple, and don't look at the field itself very
 # much, but that could be enhanced.
 
-my $lastbugid = 0;
 my $ownerid;
 my $reporterid;
 my $qacontactid;

diff --git a/template/en/default/global/user-error.html.tmpl b/template/en/default/global/user-error.html.tmpl
index 8082673a67836e64e87a0fd66b5bfa3ee15a5b6b..f16544b5db130d85cc43360a34f53011a2f50b2f 100644 (file)
--- a/template/en/default/global/user-error.html.tmpl
+++ b/template/en/default/global/user-error.html.tmpl
@@ -530,8 +530,13 @@
     [% title = "Not allowed" %]
     You tried to change the 
     <strong>[% field_descs.$field FILTER html %]</strong> field 
-    from <em>[% oldvalue FILTER html %]</em> to 
-    <em>[% newvalue FILTER html %]</em>, but only
+    [% IF oldvalue %]
+      from <em>[% oldvalue FILTER html %]</em>
+    [% END %]
+    [% IF newvalue %]
+      to <em>[% newvalue FILTER html %]</em>
+    [% END %]
+    , but only
     [% IF privs < 3 %]
       the assignee
       [% IF privs < 2 %] or reporter [% END %]