39526 - show_activity.cgi doesn't check viewing permissions

Status: RESOLVED FIXED

(Bugzilla :: Bugzilla-General, defect, P3)

Description

[Jesse Ruderman]

http://bugzilla.mozilla.org/show_bug.cgi?id=28698 gives "permission denied".
http://bugzilla.mozilla.org/show_activity.cgi?id=28698 is visible.

Comment 1

[Dave Miller [:justdave]]

moving to real milestones...

Comment 2

[Myk Melez [:myk] [@mykmelez]]

Attachment: patch to validate bug ID and check permissions to view bug

Comment 3

[Myk Melez [:myk] [@mykmelez]]

Attachment: patch that abstracts out bug ID validation

Comment 4

[Myk Melez [:myk] [@mykmelez]]

This second patch puts most of the validation code into a separate function in
CGI.pl so it can be used by other scripts that need to do bug ID validation
(like bug 39524, bug 39527, etc.).

Comment 5

[Dave Miller [:justdave]]

The check for the user belonging to the product group is unnecessary.  That's 
included in the groupset on the bug itself.  It is possible to clear the product 
group bit on a bug that's in a product that has a group, and this would prevent 
people from seeing it then.

Comment 6

[Myk Melez [:myk] [@mykmelez]]

Attachment: patch w/o CGI.pl for installations that have already installed the patch for bug 39524

Comment 7

[Myk Melez [:myk] [@mykmelez]]

accepting

Comment 8

[Myk Melez [:myk] [@mykmelez]]

Adding "review" keyword to get these on the radars of reviewers (if they aren't
already).

Comment 9

[Jacob Steenhagen]

r=jake
Fix checked in.

Comment 10

[Myk Melez [:myk] [@mykmelez]]

*** Bug 94476 has been marked as a duplicate of this bug. ***

Comment 11

[Dave Miller [:justdave]]

Moving to Bugzilla product