180545 - You can change the product/component on a bug without editbugs privs

Status: RESOLVED FIXED

(Bugzilla :: Creating/Changing Bugs, defect, P1)

Description

[Dave Miller [:justdave]]

See bug 179176.  Bryan Wellander changed the product from mozilla.org to NSPR. 
He doesn't have any privs (neither canconfirm nor editbugs).  He's also not the
reporter, qa, or assignee on that bug.  I always thought that was one of the
fields that was supposed to be protected if you weren't a primary relationship
to that bug and you didn't have editbugs privs...

Comment 1

[J. Paul Reed [:preed]]

This sounds pretty serious to me; is this a security sensitive bug (if it's a
bug at all?)

Comment 2

[Bradley Baetz (:bbaetz)]

Down with @::log_columns! We only call this for each field in @::log_columns,
and only product_id is there, not product.....

Fix is to either hack this, or change the values in the form to be numbers, not
strings. Or both.

Comment 3

[Jacob Steenhagen]

Attachment: Patch - Fun hack

Looking at this anything short of removing @::log_columns is going to be a bit
of a hack.  So, this patch seems to be the least intrusive hack.

Comment 4

[Jacob Steenhagen]

-> me

Comment 5

[Bradley Baetz (:bbaetz)]

Comment on attachment 106588 [details] [diff] [review]
Patch - Fun hack

Joy.

r=bbaetz, assuming you've tested + all

Comment 6

[Dave Miller [:justdave]]

a= justdave

Comment 7

[Jacob Steenhagen]

Checking in process_bug.cgi;
/cvsroot/mozilla/webtools/bugzilla/process_bug.cgi,v  <--  process_bug.cgi
new revision: 1.167; previous revision: 1.166
done

Comment 8

[Bradley Baetz (:bbaetz)]

Clearing security bit on fixed bug.

Affected pulls were from 2002/08/12 05:42:55 to 2002/11/18 04:27:34 US/Pacific,
+/- about 15 minutes for cvs-mirror lag

People who were not in the editbugs group could change the product or component
of a bug. The change was still logged in the activity log and mails were still
sent out (as would happen with a permitted user changing these fields).