From: travis%sedsystems.ca <>
Date: Fri, 25 Feb 2005 00:30:40 +0000 (+0000)
Subject: Bug 283085 : post_bug.cgi can be used to know which products do not exist and which... 
X-Git-Tag: bugzilla-2.19.3~263
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1e734201ceb9fe600d739ea4a0e254af857af45f;p=thirdparty%2Fbugzilla.git

Bug 283085 : post_bug.cgi can be used to know which products do not exist and which ones are not accessible
Patch by Frederic Buclin <LpSolit@gmail.com>   r=myk   a=myk
---

diff --git a/post_bug.cgi b/post_bug.cgi
index 3e5b289a8a..4f545fbb2d 100755
--- a/post_bug.cgi
+++ b/post_bug.cgi
@@ -78,12 +78,13 @@ $template->process($format->{'template'}, $vars, \$comment)
 
 ValidateComment($comment);
 
+# Check that the product exists and that the user
+# is allowed to submit bugs in this product.
 my $product = $::FORM{'product'};
-my $product_id = get_product_id($product);
-if (!$product_id) {
-    ThrowUserError("invalid_product_name",
-                   { product => $product });
+if (!CanEnterProduct($product)) {
+    ThrowUserError("entry_access_denied", {product => $product});
 }
+my $product_id = get_product_id($product);
 
 # Set cookies
 if (exists $::FORM{'product'}) {
@@ -106,10 +107,6 @@ if (defined $::FORM{'maketemplate'}) {
 umask 0;
 
 # Some sanity checking
-if (!CanEnterProduct($product)) {
-    ThrowUserError("entry_access_denied", {product => $product});
-}
-
 my $component_id = get_component_id($product_id, $::FORM{component});
 $component_id || ThrowUserError("require_component");