Fix for bug 102141: SECURITY FIX - the Product popup menu on the show_bug form listed...

have access to all of them.  It now only shows products the user has access to (and the product the bug is in, if the user is
viewing it because of some other override)
Patch by George Hotelling <george.hotelling@iconideas.com> and Dave Miller <justdave@syndicomm.com>
r= bbaetz, caillon

diff --git a/bug_form.pl b/bug_form.pl
index 67829d111c659cffa771e46d224cfe61db66d9f7..2f8cea0a58fa23b7d641637924b0b980c93aaa5e 100644 (file)
--- a/bug_form.pl
+++ b/bug_form.pl
@@ -38,7 +38,6 @@ sub bug_form_pl_sillyness {
     $zz = @::legal_keywords;
     $zz = @::legal_opsys;
     $zz = @::legal_platform;
-    $zz = @::legal_product;
     $zz = @::legal_priority;
     $zz = @::settable_resolution;
     $zz = @::legal_severity;
@@ -149,6 +148,49 @@ if (defined $URL && $URL ne "none" && $URL ne "NULL" && $URL ne "") {
     $URL = "<B>URL:</B>";
 }
 
+#
+# Make a list of products the user has access to
+#
+
+my (@prodlist, $product_popup);
+foreach my $p (sort(keys %::versions)) {
+    if ($p eq $bug{'product'}) {
+        # if it's the product the bug is already in, it's ALWAYS in
+        # the popup, period, whether the user can see it or not, and
+        # regardless of the disallownew setting.
+        push(@prodlist, $p);
+        next;
+    }
+    if (defined $::proddesc{$p} && $::proddesc{$p} eq '0') {
+        # Special hack.  If we stuffed a "0" into proddesc, that means
+        # that disallownew was set for this bug, and so we don't want
+        # to allow people to specify that product here.
+        next;
+    }
+    if(Param("usebuggroupsentry")
+        && GroupExists($p)
+        && !UserInGroup($p))
+    {
+        # If we're using bug groups to restrict entry on products, and
+        # this product has a bug group, and the user is not in that
+        # group, we don't want to include that product in this list.
+        next;
+    }
+    push(@prodlist, $p);
+}
+
+# If the user has access to multiple products, display a popup, otherwise 
+# display the current product.
+
+if (1 < @prodlist) {
+    $product_popup = "<SELECT NAME=product>" .
+        make_options(\@prodlist, $bug{'product'}) .
+        "</SELECT>";
+}
+else {
+    $product_popup = $bug{'product'};
+}
+
 print "
 <INPUT TYPE=HIDDEN NAME=\"delta_ts\" VALUE=\"$bug{'delta_ts'}\">
 <INPUT TYPE=HIDDEN NAME=\"longdesclength\" VALUE=\"$longdesclength\">
@@ -162,9 +204,7 @@ print "
     <TD ALIGN=RIGHT><B>Reporter:</B></TD><TD>$bug{'reporter'}</TD>
 </TR><TR>
     <TD ALIGN=RIGHT><B>Product:</B></TD>
-    <TD><SELECT NAME=product>" .
-    make_options(\@::legal_product, $bug{'product'}) .
-    "</SELECT></TD>
+    <TD>$product_popup</TD>
   <TD>&nbsp;</TD>
     <TD ALIGN=RIGHT><B>OS:</B></TD>
     <TD><SELECT NAME=op_sys>" .