From: bugreport%peshkin.net <>
Date: Tue, 1 Nov 2005 02:48:59 +0000 (+0000)
Subject: Bug 314198: Fix leaking list of product names in query.cgi
X-Git-Tag: bugzilla-2.22rc1~180
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7cb75c8af8b5cdcbc1040e659a4d6d2d8457d7e7;p=thirdparty%2Fbugzilla.git

Bug 314198: Fix leaking list of product names in query.cgi
Patch by Joel Peshkin <bugreport@peshkin.net>
r=lpsolit, a=justdave
---

diff --git a/template/en/default/search/search-specific.html.tmpl b/template/en/default/search/search-specific.html.tmpl
index 1ff6f17acd..dcc87130e1 100644
--- a/template/en/default/search/search-specific.html.tmpl
+++ b/template/en/default/search/search-specific.html.tmpl
@@ -74,10 +74,12 @@ for "crash secure SSL flash".
           [% FOREACH c = classification %]
             <optgroup label="[% c.name FILTER html %]">
             [% FOREACH p = c.products %]
-              <option value="[% p.name FILTER html %]"
-                [% " selected" IF lsearch(default.product, p.name) != -1 %]>
-                [% p.name FILTER html %]
-              </option>
+              [% IF user.can_see_product(p.name) %]
+                <option value="[% p.name FILTER html %]"
+                  [% " selected" IF lsearch(default.product, p.name) != -1 %]>
+                  [% p.name FILTER html %]
+                </option>
+              [% END %]
             [% END %]
             </optgroup>
           [% END %]