Skip to content

bugzilla
bugzilla
Commit 9042b58f authored by bbaetz%cs.mcgill.ca's avatar bbaetz%cs.mcgill.ca
Browse files
Options

Bug 97469 - Assignee/QA/Reporter/CC don't get email on restricted bugs.

Also fixes seeing bugs in the buglist (bug 95024), dependancy lists, tooltips, duplicates, and everywhere else I could see which checked group bugs.groupset == 0. Also fxed bug 101560, by clearing BASH_ENV r=myk,justdave
parent 35f74cea
Show whitespace changes
Inline Side-by-side
Showing with 173 additions and 154 deletions
Bug.pm
View file @ 9042b58f
...@@ -113,10 +113,9 @@ sub initBug { ...@@ -113,10 +113,9 @@ sub initBug {
groupset, delta_ts, sum(votes.count) groupset, delta_ts, sum(votes.count)
from bugs left join votes using(bug_id) from bugs left join votes using(bug_id)
where bugs.bug_id = $bug_id where bugs.bug_id = $bug_id
and bugs.groupset & $usergroupset = bugs.groupset
group by bugs.bug_id"; group by bugs.bug_id";
&::SendSQL($query); &::SendSQL(&::SelectVisible($query, $user_id, $usergroupset));
my @row; my @row;
if (@row = &::FetchSQLData()) { if (@row = &::FetchSQLData()) {
...@@ -445,6 +444,7 @@ sub Collision { ...@@ -445,6 +444,7 @@ sub Collision {
my $write = "WRITE"; # Might want to make a param to control my $write = "WRITE"; # Might want to make a param to control
# whether we do LOW_PRIORITY ... # whether we do LOW_PRIORITY ...
&::SendSQL("LOCK TABLES bugs $write, bugs_activity $write, cc $write, " . &::SendSQL("LOCK TABLES bugs $write, bugs_activity $write, cc $write, " .
"cc AS selectVisible_cc $write, " .
"profiles $write, dependencies $write, votes $write, " . "profiles $write, dependencies $write, votes $write, " .
"keywords $write, longdescs $write, fielddefs $write, " . "keywords $write, longdescs $write, fielddefs $write, " .
"keyworddefs READ, groups READ, attachments READ, products READ"); "keyworddefs READ, groups READ, attachments READ, products READ");
......
Bugzilla/Bug.pm
View file @ 9042b58f
...@@ -113,10 +113,9 @@ sub initBug { ...@@ -113,10 +113,9 @@ sub initBug {
groupset, delta_ts, sum(votes.count) groupset, delta_ts, sum(votes.count)
from bugs left join votes using(bug_id) from bugs left join votes using(bug_id)
where bugs.bug_id = $bug_id where bugs.bug_id = $bug_id
and bugs.groupset & $usergroupset = bugs.groupset
group by bugs.bug_id"; group by bugs.bug_id";
&::SendSQL($query); &::SendSQL(&::SelectVisible($query, $user_id, $usergroupset));
my @row; my @row;
if (@row = &::FetchSQLData()) { if (@row = &::FetchSQLData()) {
...@@ -445,6 +444,7 @@ sub Collision { ...@@ -445,6 +444,7 @@ sub Collision {
my $write = "WRITE"; # Might want to make a param to control my $write = "WRITE"; # Might want to make a param to control
# whether we do LOW_PRIORITY ... # whether we do LOW_PRIORITY ...
&::SendSQL("LOCK TABLES bugs $write, bugs_activity $write, cc $write, " . &::SendSQL("LOCK TABLES bugs $write, bugs_activity $write, cc $write, " .
"cc AS selectVisible_cc $write, " .
"profiles $write, dependencies $write, votes $write, " . "profiles $write, dependencies $write, votes $write, " .
"keywords $write, longdescs $write, fielddefs $write, " . "keywords $write, longdescs $write, fielddefs $write, " .
"keyworddefs READ, groups READ, attachments READ, products READ"); "keyworddefs READ, groups READ, attachments READ, products READ");
......
CGI.pl
View file @ 9042b58f
...@@ -258,88 +258,20 @@ sub ValidateBugID { ...@@ -258,88 +258,20 @@ sub ValidateBugID {
# setting those local variables to the default value of zero if # setting those local variables to the default value of zero if
# the global variables are undefined. # the global variables are undefined.
# "usergroupset" stores the set of groups the user is a member of, # First check that the bug exists
# while "userid" stores the user's unique ID. These variables are SendSQL("SELECT bug_id FROM bugs WHERE bug_id = $id");
# set globally by either confirm_login() or quietly_check_login(),
# one of which should be run before calling this function; otherwise FetchOneColumn()
# this function will treat the user as if they were not logged in
# and throw an error if they try to access a bug that requires
# permissions/authorization to access.
my $usergroupset = $::usergroupset || 0;
my $userid = $::userid || 0;
# Query the database for the bug, retrieving a boolean value that
# represents whether or not the user is authorized to access the bug.
# Users are authorized to access bugs if they are a member of all
# groups to which the bug is restricted. User group membership and
# bug restrictions are stored as bits within bitsets, so authorization
# can be determined by comparing the intersection of the user's
# bitset with the bug's bitset. If the result matches the bug's bitset
# the user is a member of all groups to which the bug is restricted
# and is authorized to access the bug.
# A user is also authorized to access a bug if she is the reporter,
# assignee, QA contact, or member of the cc: list of the bug and the bug
# allows users in those roles to see the bug. The boolean fields
# reporter_accessible, assignee_accessible, qacontact_accessible, and
# cclist_accessible identify whether or not those roles can see the bug.
# Bit arithmetic is performed by MySQL instead of Perl because bitset
# fields in the database are 64 bits wide (BIGINT), and Perl installations
# may or may not support integers larger than 32 bits. Using bitsets
# and doing bitset arithmetic is probably not cross-database compatible,
# however, so these mechanisms are likely to change in the future.
# Get data from the database about whether or not the user belongs to
# all groups the bug is in, and who are the bug's reporter and qa_contact
# along with which roles can always access the bug.
SendSQL("SELECT ((groupset & $usergroupset) = groupset) , reporter , assigned_to , qa_contact ,
reporter_accessible , assignee_accessible , qacontact_accessible , cclist_accessible
FROM bugs
WHERE bug_id = $id");
# Make sure the bug exists in the database.
MoreSQLData()
|| DisplayError("Bug #$id does not exist.") || DisplayError("Bug #$id does not exist.")
&& exit; && exit;
my ($isauthorized, $reporter, $assignee, $qacontact, $reporter_accessible, return if CanSeeBug($id, $::userid, $::usergroupset);
$assignee_accessible, $qacontact_accessible, $cclist_accessible) = FetchSQLData();
# Finish validation and return if the user is a member of all groups to which the bug belongs.
return if $isauthorized;
# Finish validation and return if the user is in a role that has access to the bug.
if ($userid) {
return
if ($reporter_accessible && $reporter == $userid)
|| ($assignee_accessible && $assignee == $userid)
|| ($qacontact_accessible && $qacontact == $userid);
}
# Try to authorize the user one more time by seeing if they are on
# the cc: list. If so, finish validation and return.
if ( $cclist_accessible ) {
my @cclist;
SendSQL("SELECT cc.who
FROM bugs , cc
WHERE bugs.bug_id = $id
AND cc.bug_id = bugs.bug_id
");
while (my ($ccwho) = FetchSQLData()) {
# more efficient to just check the var here instead of
# creating a potentially huge array to grep against
return if ($userid == $ccwho);
}
}
# The user did not pass any of the authorization tests, which means they # The user did not pass any of the authorization tests, which means they
# are not authorized to see the bug. Display an error and stop execution. # are not authorized to see the bug. Display an error and stop execution.
# The error the user sees depends on whether or not they are logged in # The error the user sees depends on whether or not they are logged in
# (i.e. $userid contains the user's positive integer ID). # (i.e. $::userid contains the user's positive integer ID).
if ($userid) { if ($::userid) {
DisplayError("You are not authorized to access bug #$id."); DisplayError("You are not authorized to access bug #$id.");
} else { } else {
DisplayError( DisplayError(
......
buglist.cgi
View file @ 9042b58f
...@@ -37,6 +37,7 @@ sub sillyness { ...@@ -37,6 +37,7 @@ sub sillyness {
$zz = $::db_name; $zz = $::db_name;
$zz = $::defaultqueryname; $zz = $::defaultqueryname;
$zz = $::unconfirmedstate; $zz = $::unconfirmedstate;
$zz = $::userid;
$zz = @::components; $zz = @::components;
$zz = @::default_column_list; $zz = @::default_column_list;
$zz = @::legal_keywords; $zz = @::legal_keywords;
...@@ -162,9 +163,7 @@ sub GenerateSQL { ...@@ -162,9 +163,7 @@ sub GenerateSQL {
"LEFT JOIN profiles map_qa_contact ON bugs.qa_contact = map_qa_contact.userid")); "LEFT JOIN profiles map_qa_contact ON bugs.qa_contact = map_qa_contact.userid"));
unshift(@wherepart, unshift(@wherepart,
("bugs.assigned_to = map_assigned_to.userid", ("bugs.assigned_to = map_assigned_to.userid",
"bugs.reporter = map_reporter.userid", "bugs.reporter = map_reporter.userid"));
"bugs.groupset & $::usergroupset = bugs.groupset"));
my $minvotes; my $minvotes;
if (defined $F{'votes'}) { if (defined $F{'votes'}) {
...@@ -805,10 +804,14 @@ sub GenerateSQL { ...@@ -805,10 +804,14 @@ sub GenerateSQL {
$suppseen{$str} = 1; $suppseen{$str} = 1;
} }
} }
my $query = ("SELECT " . join(', ', @fields) . my $query = ("SELECT " . join(', ', @fields) .
" FROM $suppstring" . " FROM $suppstring" .
" WHERE " . join(' AND ', (@wherepart, @andlist)) . " WHERE " . join(' AND ', (@wherepart, @andlist)) .
" GROUP BY bugs.bug_id"); " GROUP BY bugs.bug_id");
$query = SelectVisible($query, $::userid, $::usergroupset);
if ($debug) { if ($debug) {
print "<P><CODE>" . value_quote($query) . "</CODE><P>\n"; print "<P><CODE>" . value_quote($query) . "</CODE><P>\n";
exit(); exit();
...@@ -1069,8 +1072,6 @@ ReconnectToShadowDatabase(); ...@@ -1069,8 +1072,6 @@ ReconnectToShadowDatabase();
my $query = GenerateSQL(\@fields, undef, undef, $::buffer); my $query = GenerateSQL(\@fields, undef, undef, $::buffer);
if ($::COOKIE{'LASTORDER'}) { if ($::COOKIE{'LASTORDER'}) {
if ((!$::FORM{'order'}) || $::FORM{'order'} =~ /^reuse/i) { if ((!$::FORM{'order'}) || $::FORM{'order'} =~ /^reuse/i) {
$::FORM{'order'} = url_decode($::COOKIE{'LASTORDER'}); $::FORM{'order'} = url_decode($::COOKIE{'LASTORDER'});
...@@ -1132,6 +1133,7 @@ if ($::FORM{'debug'} && $serverpush) { ...@@ -1132,6 +1133,7 @@ if ($::FORM{'debug'} && $serverpush) {
if (Param('expectbigqueries')) { if (Param('expectbigqueries')) {
SendSQL("set option SQL_BIG_TABLES=1"); SendSQL("set option SQL_BIG_TABLES=1");
} }
SendSQL($query); SendSQL($query);
my $count = 0; my $count = 0;
......
duplicates.cgi
View file @ 9042b58f
...@@ -33,6 +33,12 @@ require "CGI.pl"; ...@@ -33,6 +33,12 @@ require "CGI.pl";
ConnectToDatabase(1); ConnectToDatabase(1);
GetVersionTable(); GetVersionTable();
quietly_check_login();
# Silly used-once warnings
$::userid = $::userid;
$::usergroupset = $::usergroupset;
my %dbmcount; my %dbmcount;
my %count; my %count;
my $dobefore = 0; my $dobefore = 0;
...@@ -195,10 +201,10 @@ $i = 0; ...@@ -195,10 +201,10 @@ $i = 0;
foreach (@sortedcount) foreach (@sortedcount)
{ {
my $id = $_; my $id = $_;
SendSQL("SELECT component, bug_severity, op_sys, target_milestone, short_desc, groupset, bug_status, resolution" . SendSQL(SelectVisible("SELECT component, bug_severity, op_sys, target_milestone, short_desc, bug_status, resolution" .
" FROM bugs WHERE bug_id = $id"); " FROM bugs WHERE bugs.bug_id = $id", $::userid, $::usergroupset));
my ($component, $severity, $op_sys, $milestone, $summary, $groupset, $bug_status, $resolution) = FetchSQLData(); next unless MoreSQLData();
next unless $groupset == 0; my ($component, $severity, $op_sys, $milestone, $summary, $bug_status, $resolution) = FetchSQLData();
$summary = html_quote($summary); $summary = html_quote($summary);
# Show all bugs except those CLOSED _OR_ VERIFIED but not INVALID or WONTFIX. # Show all bugs except those CLOSED _OR_ VERIFIED but not INVALID or WONTFIX.
......
globals.pl
View file @ 9042b58f
...@@ -20,6 +20,7 @@ ...@@ -20,6 +20,7 @@
# Contributor(s): Terry Weissman <terry@mozilla.org> # Contributor(s): Terry Weissman <terry@mozilla.org>
# Dan Mosedale <dmose@mozilla.org> # Dan Mosedale <dmose@mozilla.org>
# Jake <jake@acutex.net> # Jake <jake@acutex.net>
# Bradley Baetz <bbaetz@cs.mcgill.ca>
# Contains some global variables and routines used throughout bugzilla. # Contains some global variables and routines used throughout bugzilla.
...@@ -71,8 +72,9 @@ use Date::Parse; # For str2time(). ...@@ -71,8 +72,9 @@ use Date::Parse; # For str2time().
#use Carp; # for confess #use Carp; # for confess
use RelationSet; use RelationSet;
# $ENV{PATH} is not taint safe # Some environment variables are not taint safe
delete $ENV{PATH}; delete $ENV{PATH};
delete $ENV{BASH_ENV};
# Contains the version string for the current running Bugzilla. # Contains the version string for the current running Bugzilla.
$::param{'version'} = '2.15'; $::param{'version'} = '2.15';
...@@ -704,6 +706,98 @@ sub GenerateRandomPassword { ...@@ -704,6 +706,98 @@ sub GenerateRandomPassword {
return $password; return $password;
} }
sub SelectVisible {
my ($query, $userid, $usergroupset) = @_;
# Run the SQL $query with the additional restriction that
# the bugs can be seen by $userid. $usergroupset is provided
# as an optimisation when this is already known, eg from CGI.pl
# If not present, it will be obtained from the db.
# Assumes that 'bugs' is mentioned as a table name. You should
# also make sure that bug_id is qualified bugs.bug_id!
# Your query must have a WHERE clause. This is unlikely to be a problem.
# Also, note that mySQL requires aliases for tables to be locked, as well
# This means that if you change the name from selectVisible_cc (or add
# additional tables), you will need to update anywhere which does a
# LOCK TABLE, and then calls routines which call this
$usergroupset = 0 unless $userid;
unless (defined($usergroupset)) {
PushGlobalSQLState();
SendSQL("SELECT groupset FROM profiles WHERE userid = $userid");
$usergroupset = FetchOneColumn();
PopGlobalSQLState();
}
# Users are authorized to access bugs if they are a member of all
# groups to which the bug is restricted. User group membership and
# bug restrictions are stored as bits within bitsets, so authorization
# can be determined by comparing the intersection of the user's
# bitset with the bug's bitset. If the result matches the bug's bitset
# the user is a member of all groups to which the bug is restricted
# and is authorized to access the bug.
# A user is also authorized to access a bug if she is the reporter,
# assignee, QA contact, or member of the cc: list of the bug and the bug
# allows users in those roles to see the bug. The boolean fields
# reporter_accessible, assignee_accessible, qacontact_accessible, and
# cclist_accessible identify whether or not those roles can see the bug.
# Bit arithmetic is performed by MySQL instead of Perl because bitset
# fields in the database are 64 bits wide (BIGINT), and Perl installations
# may or may not support integers larger than 32 bits. Using bitsets
# and doing bitset arithmetic is probably not cross-database compatible,
# however, so these mechanisms are likely to change in the future.
my $replace = " ";
if ($userid) {
$replace .= "LEFT JOIN cc selectVisible_cc ON
bugs.bug_id = selectVisible_cc.bug_id AND
selectVisible_cc.who = $userid "
}
$replace .= "WHERE ((bugs.groupset & $usergroupset) = bugs.groupset ";
if ($userid) {
# There is a mysql bug affecting v3.22 and 3.23 (at least), where this will
# cause all rows to be returned! We work arround this by adding an not isnull
# test to the JOINed cc table. See http://lists.mysql.com/cgi-ez/ezmlm-cgi?9:mss:11417
# Its needed, even though it shouldn't be
$replace .= "OR (bugs.reporter_accessible = 1 AND bugs.reporter = $userid)
OR (bugs.assignee_accessible = 1 AND bugs.assigned_to = $userid)
OR (bugs.qacontact_accessible = 1 AND bugs.qa_contact = $userid)
OR (bugs.cclist_accessible = 1 AND selectVisible_cc.who = $userid AND not isnull(selectVisible_cc.who))";
}
$replace .= ") AND ";
$query =~ s/\sWHERE\s/$replace/i;
return $query;
}
sub CanSeeBug {
# Note that we pass in the usergroupset, since this is known
# in most cases (ie viewing bugs). Maybe make this an optional
# parameter?
my ($id, $userid, $usergroupset) = @_;
# Query the database for the bug, retrieving a boolean value that
# represents whether or not the user is authorized to access the bug.
PushGlobalSQLState();
SendSQL(SelectVisible("SELECT bugs.bug_id FROM bugs WHERE bugs.bug_id = $id",
$userid, $usergroupset));
my $ret = defined(FetchSQLData());
PopGlobalSQLState();
return $ret;
}
sub ValidatePassword { sub ValidatePassword {
# Determines whether or not a password is valid (i.e. meets Bugzilla's # Determines whether or not a password is valid (i.e. meets Bugzilla's
...@@ -835,16 +929,22 @@ sub DBNameToIdAndCheck { ...@@ -835,16 +929,22 @@ sub DBNameToIdAndCheck {
exit(0); exit(0);
} }
# Use detaint_string() when you know that there is no way that the data # Use trick_taint() when you know that there is no way that the data
# in a scalar can be tainted, but taint mode still bails on it. # in a scalar can be tainted, but taint mode still bails on it.
# WARNING!! Using this routine on data that really could be tainted # WARNING!! Using this routine on data that really could be tainted
# defeats the purpose of taint mode. It should only be # defeats the purpose of taint mode. It should only be
# used on variables that cannot be touched by users. # used on variables that cannot be touched by users.
sub detaint_string { sub trick_taint {
my ($str) = @_; $_[0] =~ /^(.*)$/s;
$str =~ m/^(.*)$/s; $_[0] = $1;
$str = $1; return (defined($_[0]));
}
sub detaint_natural {
$_[0] =~ /^(\d+)$/;
$_[0] = $1;
return (defined($_[0]));
} }
# This routine quoteUrls contains inspirations from the HTML::FromText CPAN # This routine quoteUrls contains inspirations from the HTML::FromText CPAN
...@@ -983,7 +1083,9 @@ sub GetBugLink { ...@@ -983,7 +1083,9 @@ sub GetBugLink {
$link_text = value_quote($link_text); $link_text = value_quote($link_text);
$link_return .= qq{<a href="show_bug.cgi?id=$bug_num" title="$bug_stat}; $link_return .= qq{<a href="show_bug.cgi?id=$bug_num" title="$bug_stat};
if ($bug_res ne "") {$link_return .= " $bug_res"} if ($bug_res ne "") {$link_return .= " $bug_res"}
if ($bug_grp == 0) { $link_return .= " - $bug_desc" } if ($bug_grp == 0 || CanSeeBug($bug_num, $::userid, $::usergroupset)) {
$link_return .= " - $bug_desc";
}
$link_return .= qq{">$link_text</a>}; $link_return .= qq{">$link_text</a>};
if ($bug_res ne "") { $link_return .= "</strike>" } if ($bug_res ne "") { $link_return .= "</strike>" }
if ($bug_stat eq "UNCONFIRMED") { $link_return .= "</i>"} if ($bug_stat eq "UNCONFIRMED") { $link_return .= "</i>"}
...@@ -1128,7 +1230,7 @@ sub SqlQuote { ...@@ -1128,7 +1230,7 @@ sub SqlQuote {
$str =~ s/([\\\'])/\\$1/g; $str =~ s/([\\\'])/\\$1/g;
$str =~ s/\0/\\0/g; $str =~ s/\0/\\0/g;
# If it's been SqlQuote()ed, then it's safe, so we tell -T that. # If it's been SqlQuote()ed, then it's safe, so we tell -T that.
$str = detaint_string($str); trick_taint($str);
return "'$str'"; return "'$str'";
} }
......
long_list.cgi
View file @ 9042b58f
...@@ -32,6 +32,7 @@ require "CGI.pl"; ...@@ -32,6 +32,7 @@ require "CGI.pl";
sub sillyness { sub sillyness {
my $zz; my $zz;
$zz = $::legal_keywords; $zz = $::legal_keywords;
$zz = $::userid;
$zz = $::usergroupset; $zz = $::usergroupset;
$zz = %::FORM; $zz = %::FORM;
} }
...@@ -68,12 +69,12 @@ select ...@@ -68,12 +69,12 @@ select
bugs.status_whiteboard, bugs.status_whiteboard,
bugs.keywords bugs.keywords
from bugs,profiles assign,profiles report from bugs,profiles assign,profiles report
where assign.userid = bugs.assigned_to and report.userid = bugs.reporter and where assign.userid = bugs.assigned_to and report.userid = bugs.reporter and";
bugs.groupset & $::usergroupset = bugs.groupset and";
$::FORM{'buglist'} = "" unless exists $::FORM{'buglist'}; $::FORM{'buglist'} = "" unless exists $::FORM{'buglist'};
foreach my $bug (split(/:/, $::FORM{'buglist'})) { foreach my $bug (split(/:/, $::FORM{'buglist'})) {
SendSQL("$generic_query bugs.bug_id = $bug"); SendSQL(SelectVisible("$generic_query bugs.bug_id = $bug",
$::userid, $::usergroupset));
my @row; my @row;
if (@row = FetchSQLData()) { if (@row = FetchSQLData()) {
......
process_bug.cgi
View file @ 9042b58f
...@@ -352,6 +352,11 @@ empowered user, may make that change to the $f field. ...@@ -352,6 +352,11 @@ empowered user, may make that change to the $f field.
# Confirm that the reporter of the current bug can access the bug we are duping to. # Confirm that the reporter of the current bug can access the bug we are duping to.
sub DuplicateUserConfirm { sub DuplicateUserConfirm {
# if we've already been through here, then exit
if (defined $::FORM{'confirm_add_duplicate'}) {
return;
}
my $dupe = trim($::FORM{'id'}); my $dupe = trim($::FORM{'id'});
my $original = trim($::FORM{'dup_id'}); my $original = trim($::FORM{'dup_id'});
...@@ -360,45 +365,13 @@ sub DuplicateUserConfirm { ...@@ -360,45 +365,13 @@ sub DuplicateUserConfirm {
SendSQL("SELECT profiles.groupset FROM profiles WHERE profiles.userid =".SqlQuote($reporter)); SendSQL("SELECT profiles.groupset FROM profiles WHERE profiles.userid =".SqlQuote($reporter));
my $reportergroupset = FetchOneColumn(); my $reportergroupset = FetchOneColumn();
SendSQL("SELECT ((groupset & $reportergroupset) = groupset) , reporter , assigned_to , qa_contact , if (CanSeeBug($original, $reporter, $reportergroupset)) {
reporter_accessible , assignee_accessible , qacontact_accessible , cclist_accessible
FROM bugs
WHERE bug_id = $original");
my ($isauthorized, $originalreporter, $assignee, $qacontact, $reporter_accessible,
$assignee_accessible, $qacontact_accessible, $cclist_accessible) = FetchSQLData();
# If reporter is authorized via the database, or is the original reporter, assignee,
# or QA Contact, we'll automatically confirm they can be added to the cc list
if ($isauthorized
|| ($reporter_accessible && $originalreporter == $reporter)
|| ($assignee_accessible && $assignee == $reporter)
|| ($qacontact_accessible && $qacontact == $reporter)) {
$::FORM{'confirm_add_duplicate'} = "1";
return;
}
# Try to authorize the user one more time by seeing if they are on
# the cc: list. If so, finish validation and return.
if ($cclist_accessible ) {
my @cclist;
SendSQL("SELECT cc.who
FROM bugs , cc
WHERE bugs.bug_id = $original
AND cc.bug_id = bugs.bug_id
");
while (my ($ccwho) = FetchSQLData()) {
if ($reporter == $ccwho) {
$::FORM{'confirm_add_duplicate'} = "1"; $::FORM{'confirm_add_duplicate'} = "1";
return; return;
} }
}
}
if (defined $::FORM{'confirm_add_duplicate'}) { SendSQL("SELECT cclist_accessible FROM bugs WHERE bug_id = $original");
return; my $cclist_accessible = FetchOneColumn();
}
# Once in this part of the subroutine, the user has not been auto-validated # Once in this part of the subroutine, the user has not been auto-validated
# and the duper has not chosen whether or not to add to CC list, so let's # and the duper has not chosen whether or not to add to CC list, so let's
...@@ -985,6 +958,7 @@ foreach my $id (@idlist) { ...@@ -985,6 +958,7 @@ foreach my $id (@idlist) {
my $write = "WRITE"; # Might want to make a param to control my $write = "WRITE"; # Might want to make a param to control
# whether we do LOW_PRIORITY ... # whether we do LOW_PRIORITY ...
SendSQL("LOCK TABLES bugs $write, bugs_activity $write, cc $write, " . SendSQL("LOCK TABLES bugs $write, bugs_activity $write, cc $write, " .
"cc AS selectVisible_cc $write, " .
"profiles $write, dependencies $write, votes $write, " . "profiles $write, dependencies $write, votes $write, " .
"keywords $write, longdescs $write, fielddefs $write, " . "keywords $write, longdescs $write, fielddefs $write, " .
"keyworddefs READ, groups READ, attachments READ, products READ"); "keyworddefs READ, groups READ, attachments READ, products READ");
......
processmail
View file @ 9042b58f
...@@ -111,8 +111,8 @@ sub ProcessOneBug { ...@@ -111,8 +111,8 @@ sub ProcessOneBug {
} }
my ($start, $end) = (@row); my ($start, $end) = (@row);
# $start and $end are considered safe because users can't touch them # $start and $end are considered safe because users can't touch them
$start = detaint_string($start); trick_taint($start);
$end = detaint_string($end); trick_taint($end);
my $ccSet = new RelationSet(); my $ccSet = new RelationSet();
$ccSet->mergeFromDB("SELECT who FROM cc WHERE bug_id = $id"); $ccSet->mergeFromDB("SELECT who FROM cc WHERE bug_id = $id");
...@@ -645,30 +645,25 @@ sub NewProcessOnePerson ($$$$$$$$$$$) { ...@@ -645,30 +645,25 @@ sub NewProcessOnePerson ($$$$$$$$$$$) {
return; return;
} }
# Sanitize $values{'groupset'}
if ($values{'groupset'} =~ m/(\d+)/) { SendSQL("SELECT userid, groupset " .
$values{'groupset'} = $1;
} else {
$values{'groupset'} = 0;
}
SendSQL("SELECT userid, groupset & $values{'groupset'} " .
"FROM profiles WHERE login_name = " . SqlQuote($person)); "FROM profiles WHERE login_name = " . SqlQuote($person));
my ($userid, $groupset) = (FetchSQLData()); my ($userid, $groupset) = (FetchSQLData());
$seen{$person} = 1; $seen{$person} = 1;
detaint_natural($userid);
detaint_natural($groupset);
# if this person doesn't have permission to see info on this bug, # if this person doesn't have permission to see info on this bug,
# return. # return.
# #
# XXX - I _think_ this currently means that if a bug is suddenly given # XXX - This currently means that if a bug is suddenly given
# more restrictive permissions, people without those permissions won't # more restrictive permissions, people without those permissions won't
# see the action of restricting the bug itself; the bug will just # see the action of restricting the bug itself; the bug will just
# quietly disappear from their radar. # quietly disappear from their radar.
# #
if ($groupset ne $values{'groupset'}) { return unless CanSeeBug($id, $userid, $groupset);
return;
}
my %mailhead = %defmailhead; my %mailhead = %defmailhead;
...@@ -824,9 +819,10 @@ if ($ARGV[0] eq "rescanall") { ...@@ -824,9 +819,10 @@ if ($ARGV[0] eq "rescanall") {
push @list, $row[0]; push @list, $row[0];
} }
foreach my $id (@list) { foreach my $id (@list) {
$ARGV[0] = $id; if (detaint_natural($id)) {
print "<br> Doing bug $id\n"; print "<br> Doing bug $id\n";
ProcessOneBug($ARGV[0]); ProcessOneBug($id);
}
} }
} else { } else {
my $bugnum; my $bugnum;
......
showdependencygraph.cgi
View file @ 9042b58f
...@@ -29,7 +29,9 @@ ConnectToDatabase(); ...@@ -29,7 +29,9 @@ ConnectToDatabase();
quietly_check_login(); quietly_check_login();
$::usergroupset = $::usergroupset; # More warning suppression silliness. # More warning suppression silliness.
$::userid = $::userid;
$::usergroupset = $::usergroupset;
###################################################################### ######################################################################
# Begin Data/Security Validation # Begin Data/Security Validation
...@@ -122,7 +124,9 @@ node [URL="${urlbase}show_bug.cgi?id=\\N", style=filled, color=lightgrey] ...@@ -122,7 +124,9 @@ node [URL="${urlbase}show_bug.cgi?id=\\N", style=filled, color=lightgrey]
my $summary = ""; my $summary = "";
my $stat; my $stat;
if ($::FORM{'showsummary'}) { if ($::FORM{'showsummary'}) {
SendSQL("select bug_status, short_desc from bugs where bug_id = $k and bugs.groupset & $::usergroupset = bugs.groupset"); SendSQL(SelectVisible("select bug_status, short_desc from bugs where bug_id = $k",
$::userid,
$::usergroupset));
($stat, $summary) = (FetchSQLData()); ($stat, $summary) = (FetchSQLData());
$stat = "NEW" if !defined $stat; $stat = "NEW" if !defined $stat;
$summary = "" if !defined $summary; $summary = "" if !defined $summary;
......
showdependencytree.cgi
View file @ 9042b58f
...@@ -34,7 +34,9 @@ ConnectToDatabase(); ...@@ -34,7 +34,9 @@ ConnectToDatabase();
quietly_check_login(); quietly_check_login();
$::usergroupset = $::usergroupset; # More warning suppression silliness. # More warning suppression silliness.
$::userid = $::userid;
$::usergroupset = $::usergroupset;
###################################################################### ######################################################################
# Begin Data/Security Validation # Begin Data/Security Validation
...@@ -128,10 +130,10 @@ sub DumpKids { ...@@ -128,10 +130,10 @@ sub DumpKids {
my ($bugid, $stat, $milestone) = ("", "", ""); my ($bugid, $stat, $milestone) = ("", "", "");
my ($userid, $short_desc) = ("", ""); my ($userid, $short_desc) = ("", "");
if (Param('usetargetmilestone')) { if (Param('usetargetmilestone')) {
SendSQL("select bug_id, bug_status, target_milestone, assigned_to, short_desc from bugs where bug_id = $kid and bugs.groupset & $::usergroupset = bugs.groupset"); SendSQL(SelectVisible("select bugs.bug_id, bug_status, target_milestone, assigned_to, short_desc from bugs where bugs.bug_id = $kid", $::userid, $::usergroupset));
($bugid, $stat, $milestone, $userid, $short_desc) = (FetchSQLData()); ($bugid, $stat, $milestone, $userid, $short_desc) = (FetchSQLData());
} else { } else {
SendSQL("select bug_id, bug_status, assigned_to, short_desc from bugs where bug_id = $kid and bugs.groupset & $::usergroupset = bugs.groupset"); SendSQL(SelectVisible("select bugs.bug_id, bug_status, assigned_to, short_desc from bugs where bugs.bug_id = $kid", $::userid, $::usergroupset));
($bugid, $stat, $userid, $short_desc) = (FetchSQLData()); ($bugid, $stat, $userid, $short_desc) = (FetchSQLData());
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment