Closed
Bug 39526
Opened 25 years ago
Closed 24 years ago
show_activity.cgi doesn't check viewing permissions
Categories
(Bugzilla :: Bugzilla-General, defect, P3)
Tracking
()
RESOLVED
FIXED
Bugzilla 2.14
People
(Reporter: jruderman, Assigned: myk)
References
()
Details
(Whiteboard: security)
Attachments
(3 files)
2.79 KB,
patch
|
Details | Diff | Splinter Review | |
3.72 KB,
patch
|
Details | Diff | Splinter Review | |
1.69 KB,
patch
|
Details | Diff | Splinter Review |
http://bugzilla.mozilla.org/show_bug.cgi?id=28698 gives "permission denied". http://bugzilla.mozilla.org/show_activity.cgi?id=28698 is visible.
Updated•24 years ago
|
Whiteboard: 2.14
Updated•24 years ago
|
Whiteboard: 2.14 → 2.14, security
Comment 1•24 years ago
|
||
moving to real milestones...
Whiteboard: 2.14, security → security
Target Milestone: --- → Bugzilla 2.14
Assignee | ||
Comment 2•24 years ago
|
||
Assignee | ||
Comment 3•24 years ago
|
||
Assignee | ||
Comment 4•24 years ago
|
||
This second patch puts most of the validation code into a separate function in CGI.pl so it can be used by other scripts that need to do bug ID validation (like bug 39524, bug 39527, etc.).
Assignee: tara → myk
Keywords: patch
Comment 5•24 years ago
|
||
The check for the user belonging to the product group is unnecessary. That's included in the groupset on the bug itself. It is possible to clear the product group bit on a bug that's in a product that has a group, and this would prevent people from seeing it then.
Assignee | ||
Comment 6•24 years ago
|
||
Assignee | ||
Comment 8•24 years ago
|
||
Adding "review" keyword to get these on the radars of reviewers (if they aren't already).
Keywords: review
Comment 9•24 years ago
|
||
r=jake Fix checked in.
Status: ASSIGNED → RESOLVED
Closed: 24 years ago
Resolution: --- → FIXED
Assignee | ||
Comment 10•23 years ago
|
||
*** Bug 94476 has been marked as a duplicate of this bug. ***
Comment 11•23 years ago
|
||
Moving to Bugzilla product
Component: Bugzilla → Bugzilla-General
Product: Webtools → Bugzilla
Version: other → unspecified
Updated•12 years ago
|
QA Contact: matty_is_a_geek → default-qa
You need to log in
before you can comment on or make changes to this bug.
Description
•