From: lpsolit%gmail.com <>
Date: Wed, 1 Nov 2006 08:58:15 +0000 (+0000)
Subject: Bug 351337: Users can add bugs to groups that they are members of, even if the group... 
X-Git-Tag: bugzilla-2.22.2~43
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a98d0a4b0900f7de34608511a3c96305dcf1b0c7;p=thirdparty%2Fbugzilla.git

Bug 351337: Users can add bugs to groups that they are members of, even if the group controls are NA/NA - Patch by Frédéric Buclin <LpSolit@gmail.com> r=mkanat a=myk
---

diff --git a/post_bug.cgi b/post_bug.cgi
index 5213549940..dd6d020d82 100755
--- a/post_bug.cgi
+++ b/post_bug.cgi
@@ -364,14 +364,24 @@ foreach my $b (grep(/^bit-\d*$/, $cgi->param())) {
             $vars->{'bit'} = $v;
             ThrowCodeError("inactive_group");
         }
-        my ($permit) = $user->in_group_id($v);
-        if (!$permit) {
-            SendSQL("SELECT othercontrol FROM group_control_map
-                     WHERE group_id = $v AND product_id = $product_id");
-            my ($othercontrol) = FetchSQLData();
-            $permit = (($othercontrol == CONTROLMAPSHOWN)
-                       || ($othercontrol == CONTROLMAPDEFAULT));
-        }
+        my ($membercontrol, $othercontrol) =
+            $dbh->selectrow_array('SELECT membercontrol, othercontrol
+                                     FROM group_control_map
+                                    WHERE group_id = ? AND product_id = ?',
+                                    undef, ($v, $product_id));
+
+        # If these values are undefined or zero, then this group
+        # cannot be a valid one for this product.
+        next unless ($membercontrol || $othercontrol);
+
+        my $permit = ($user->in_group_id($v)
+                      && ($membercontrol == CONTROLMAPSHOWN
+                          || $membercontrol == CONTROLMAPDEFAULT))
+                     ||
+                       (!$user->in_group_id($v)
+                        && ($othercontrol == CONTROLMAPSHOWN
+                            || $othercontrol == CONTROLMAPDEFAULT));
+
         if ($permit) {
             push(@groupstoadd, $v)
         }