214457 - Updated user page is useless

Status: RESOLVED FIXED

(Bugzilla :: Administration, task)

Description

[timeless]

User-Agent: Mozilla/3.0 (BeOS R4.5;US) Opera 3.60  [en]

Steps:
Revoke privs from someone
Quit (Opera3)
Run Opera3
click 'users' near 'Edit' in the bugzilla footer
Get:
Bugzilla Version 2.17.1
Updated user
 
Dropped user from group editbugs
Dropped user from group canconfirm
Back to the index, Add a new user or edit more users.

Problems:
1. No information about what user i edited
2. For some reason Opera keeps giving me this page instead of the edit users page. which means i can't edit the user
3. I can't quickly from this page edit the user i just edited. (i'd like to restore his privs)
4. I can't easily search for another user (because of 2 and this interface)

Comment 1

[timeless]

Attachment: edit user again, delete user, indicate what was edited

Comment 2

[GavinS]

Comment on attachment 131110 [details] [diff] [review]
edit user again, delete user, indicate what was edited

>-    PutHeader("Delete user");
>+    PutHeader("Delete user " . html_quote($user));

Doesn't this cause the <title> to be doubly html quoted? i.e. once here, and
then again in the global template?

When I did the patch for bug#206037, I found that I had to change the global
header template a bit, to correctly filter stuff coming from PutHeader(). The
patch for bug#206037 also contains much of the fix for this bug.

>     print "</FORM>";
>+    if ($candelete) {
>+        print "<FORM METHOD=POST ACTION=editusers.cgi>\n";
>+        print "<INPUT TYPE=SUBMIT VALUE=\"Delete User\">\n";
>+        print "<INPUT TYPE=HIDDEN NAME=\"action\" VALUE=\"del\">\n";
>+        print "<INPUT TYPE=HIDDEN NAME=\"user\" VALUE=\"$user\">\n";
>+        print "</FORM>";
>+    }

Should the user be value_quoted()?

Comment 3

[timeless]

the delete user code was copied from elsewhere. i could change both if asked.

Comment 4

[Dave Miller [:justdave]]

Comment on attachment 131110 [details] [diff] [review]
edit user again, delete user, indicate what was edited

I agree with Gavin's review comments.  PutHeader gets quoted, so you don't have
to quote stuff going into it.  And yes, the failure to quote $user in that one
value is covered on a another bug, so we can skip that for now (you're just
moving existing code).

Comment 5

[timeless]

Attachment: edit user again, delete user, indicate what was edited. don't double quote headers

Comment 6

[timeless]

mozilla/webtools/bugzilla/editusers.cgi 	1.49