[SECURITY] Bug 250605: Changes to the metadata (filename, description, mime type...

Patch by Joel Peshkin <bugreport@peshkin.net>
r=kiko,justdave, a=justdave

diff --git a/Bugzilla/BugMail.pm b/Bugzilla/BugMail.pm
index 40a40dc2beb49a8488930932b0c3b157c5c7f361..9299707814111fb29e010959a4a81df43ecda128 100644 (file)
--- a/Bugzilla/BugMail.pm
+++ b/Bugzilla/BugMail.pm
@@ -238,6 +238,11 @@ sub ProcessOneBug($) {
             $old = FormatTimeUnit($old);
             $new = FormatTimeUnit($new);
         }
+        if ($attachid) {
+            SendSQL("SELECT isprivate FROM attachments 
+                     WHERE attach_id = $attachid");
+            $diffpart->{'isprivate'} = FetchOneColumn();
+        }
         $difftext = FormatTriple($what, $old, $new);
         $diffpart->{'header'} = $diffheader;
         $diffpart->{'fieldname'} = $fieldname;
@@ -772,6 +777,11 @@ sub NewProcessOnePerson ($$$$$$$$$$$$$) {
             if ($user->groups->{Param("timetrackinggroup")}) {
                 $add_diff = 1;
             }
+        } elsif (($diff->{'isprivate'}) 
+                 && Param('insidergroup')
+                 && !($user->groups->{Param('insidergroup')})
+                ) {
+            $add_diff = 0;
         } else {
             $add_diff = 1;
         }