157704 - if you delete a product when usebuggroups is ON, administrator's right may change

Status: RESOLVED FIXED

(Bugzilla :: User Accounts, defect)

Description

[R K Singh]

Hi There 

I was going through Bugzilla code. I found one bug in "editproducts.cgi".

fileName: editproducts.cgi # LineNumber : 651 "AND (groupset != 
9223372036854710271)");

but as per my knowledge and as defined in globals.pl Admin bit munber is 
9223372036854775807

So I think it can change admin's right while deleting a product when 
usebuggroups is ON.

Correct me if I am wrong.

Thanks & Regards
R K Singh

Comment 1

[Joel Peshkin]

This looks like a real error.

The only differrence between these values is that the value in editproducts.cgi
is missing the 2^16 bit.  

I'll be happy to make a patch if it is OK to write/submit a patch where the
benefit is seen only by inspection and it is tested just to make sure it doesn't
break anything.

Comment 2

[Bradley Baetz (:bbaetz)]

Use $::admingroupset from globals.pol (or whatever the var is called)

Comment 3

[Dave Miller [:justdave]]

Is this even still an issue?  I think the groups rewrite fixed this (since
there's a separate admin group which is inherited now instead of the admin being
a member of every group)

Comment 4

[Dave Miller [:justdave]]

joel: ping (see comment #3)

Comment 5

[Joel Peshkin]

This would only impact the old bugzillas.  The new group system already takes
this into account during conversion.  So, unless someone wants to fix this on
the 2.16 branch, there is no change to make.

Comment 6

[Dave Miller [:justdave]]

although it's admittedly a minor thing, it does meet the qualifications of a
security problem, since the admin could accidently change his own privs.  And
the timing is perfect since we're going to be doing a 2.16.3 release shortly anyway.

Comment 7

[Dave Miller [:justdave]]

Attachment: patch against 2.16.2

This patch is against version 2.16.2.  Do note that as mentioned in earlier
comments, this problem is not present in 2.17.

Comment 9

[Joel Peshkin]

From the standpoint of being worth an update, it should be included.  There is
no reason I can see for an advisory, though.  This lets and admin lose privs
rather than creating a hole.

Comment 10

[Dave Miller [:justdave]]

mine

Comment 11

[Dave Miller [:justdave]]

Checked in on BUGZILLA-2_16-BRANCH

Checking in editproducts.cgi;
/cvsroot/mozilla/webtools/bugzilla/editproducts.cgi,v  <--  editproducts.cgi
new revision: 1.24.2.3; previous revision: 1.24.2.2
done