Closed Bug 184256 Opened 22 years ago Closed 22 years ago

Canedit group_control_map entry does not prevent making attachments

Categories

(Bugzilla :: Attachments & Requests, defect, P1)

2.17.1

Tracking

()

RESOLVED FIXED
Bugzilla 2.18

People

(Reporter: bugreport, Assigned: bugreport)

Details

Attachments

(1 file, 1 obsolete file)

A user who is not supposed to be able to comment on or change a bug in a particular product because of the canedit group_control_map entry can still create (and probably change) attachments. While they can only add information, but they are not supposed to be able to do so.
I'll fix today
Status: NEW → ASSIGNED
Priority: -- → P1
Target Milestone: --- → Bugzilla 2.18
Attached patch The fix (obsolete) — Splinter Review
Attachment #108683 - Flags: review?(bbaetz)
Comment on attachment 108683 [details] [diff] [review] The fix You need to change Attachment.pm::canedit, too, for the show_bug ui to be correct. validateCanChangeAttachment could then be rolled into validateCanEdit, although tha tmay be a bad idea, since we don't want the group lookup running for each obsoleted attachment.
Attachment #108683 - Flags: review?(bbaetz) → review-
Attached patch patch v2Splinter Review
This adds supression of the Attachment.pm edit fields. It is a single lookup for the bug.
Attachment #108683 - Attachment is obsolete: true
Attachment #108812 - Flags: review?(bbaetz)
Attachment #108812 - Flags: review?(bbaetz) → review+
Flags: approval?
Flags: approval? → approval+
Checking in Attachment.pm; /cvsroot/mozilla/webtools/bugzilla/Attachment.pm,v <-- Attachment.pm new revision: 1.13; previous revision: 1.12 done Checking in attachment.cgi; /cvsroot/mozilla/webtools/bugzilla/attachment.cgi,v <-- attachment.cgi new revision: 1.34; previous revision: 1.33 done
Status: ASSIGNED → RESOLVED
Closed: 22 years ago
Resolution: --- → FIXED
QA Contact: matty_is_a_geek → default-qa
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: