1009406 - A user with local editcomponents privs cannot update the inclusion and exclusion lists when the flagtype is already restricted to products the user cannot edit

Status: RESOLVED FIXED

(Bugzilla :: Administration, task)

Description

[Simon Green]

UserA has editcomponents privilege on ProdA and ProdB
FlagX currently has inclusion on ProdB and ProdC (presumably set up by a person with full editcomponents privileges)

User A goes edit FlagX so the inclusions list also has ProdA in it.

Expected result:
FlagX now has ProdA, ProdB and ProdC in the inclusion list.

Actual result:
Either the product with the id [ProdC's id] does not exist or you don't have access to it.

The issues is in the set_clusions sub in Bugzilla::FlagTypes, where it is checking all products, not just the changes. I'm not sure about the best way of fixing this.

Comment 1

[Simon Green]

I think the best way is to get the current clusion list, and only check the difference. That seems the best way.

(my original idea was ->set_clusions(inclusions => { add => [...], remove => [...] }, exclusions => {  add => [...], remove => [...] }}, but that really would be making more worse not better, and not solve the actual problem.

Comment 2

[Frédéric Buclin]

Let's try a more descriptive bug summary. :)

This bug exists since 4.2 when the ability for users with local editcomponents privs to edit flags has been implemented, see bug 529974.

Comment 3

[Simon Green]

Attachment: bug1009406-v1.patch

Comment 4

[David Lawrence [:dkl]]

Comment on attachment 8422096 [details] [diff] [review]
bug1009406-v1.patch

Review of attachment 8422096 [details] [diff] [review]:
-----------------------------------------------------------------

r=dkl

Comment 5

[David Lawrence [:dkl]]

Simon, do you have checkin capability with your new account name? Should I commit this for you?

dkl

Comment 6

[Simon Green]

To ssh://[e-mail]/bugzilla/bugzilla.git
   caf2197..847191a  master -> master

To ssh://[e-mail]/bugzilla/bugzilla.git
   1e5bdcd..8e3d2de  4.4 -> 4.4

(In reply to David Lawrence [:dkl] from comment #5)
> Simon, do you have checkin capability with your new account name? Should I
> commit this for you?

Yeah, checkins are tied to ssh keys not e-mail address (at least for non Moco accounts).

  -- simon