From 3052fc63f260c68eda83c65f132a733e466eecf1 Mon Sep 17 00:00:00 2001 From: "lpsolit%gmail.com" <> Date: Thu, 23 Aug 2007 20:42:53 +0000 Subject: [PATCH] =?utf8?q?Bug=20382056:=20[SECURITY]=20Bugzilla::Webservic?= =?utf8?q?e::Bug->get=5Fbugs()=20doesn't=20check=20if=20the=20user=20is=20?= =?utf8?q?in=20the=20timetracking=20group=20when=20returning=20data=20-=20?= =?utf8?q?Patch=20by=20Fr=C3=83=C2=A9d=C3=83=C2=A9ric=20Buclin=20=20r=3Dmkanat=20a=3DLpSolit?= MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit --- Bugzilla/WebService/Bug.pm | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Bugzilla/WebService/Bug.pm b/Bugzilla/WebService/Bug.pm index a2710c4824..14ed2e7fdd 100755 --- a/Bugzilla/WebService/Bug.pm +++ b/Bugzilla/WebService/Bug.pm @@ -70,6 +70,13 @@ sub get_bugs { ValidateBugID($bug_id); my $bug = new Bugzilla::Bug($bug_id); + # Timetracking fields are deleted if the user doesn't belong to + # the corresponding group. + unless (Bugzilla->user->in_group(Bugzilla->params->{'timetrackinggroup'})) { + delete $bug->{'estimated_time'}; + delete $bug->{'remaining_time'}; + delete $bug->{'deadline'}; + } # This is done in this fashion in order to produce a stable API. # The internals of Bugzilla::Bug are not stable enough to just # return them directly. -- 2.47.2