217606 - Show dependency tree does not work for users without access to some of bugs

Status: RESOLVED WORKSFORME

(Bugzilla :: Query/Bug List, defect)

Description

[Roman Starek]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5a) Gecko/20030718
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5a) Gecko/20030718

User belongs to one group, say reader. Users creatings bugs under group say
buggers. Some of those bugs are restricted just to group buggers. And the
problem is. User from group reader is not able to see dependency tree for some
public bugs, if there are some private bugs in dependency tree. 
Above mentioned behaviour disappeared after setting user to all groups we have.
I can reproduce this only on my bugzilla instalation.

Reproducible: Always

Steps to Reproduce:
1.
2.
3.




[Thu Aug 28 16:22:21 2003] [error] [client 192.168.100.74] [Thu Aug 28 16:22:21
2003] showdependencytree.cgi: Use of uninitialized value in string eq at
globals.pl line 1321., referer: http://192.168.100.214/Bugzilla/show_bug.cgi?id=504
[Thu Aug 28 16:22:21 2003] [error] [client 192.168.100.74] [Thu Aug 28 16:22:21
2003] showdependencytree.cgi: Use of uninitialized value in string eq at
globals.pl line 1321., referer: http://192.168.100.214/Bugzilla/show_bug.cgi?id=504
[Thu Aug 28 16:58:20 2003] [error] [client 192.168.100.74] Premature end of
script headers: showdependencytree.cgi, referer:
http://192.168.100.214/Bugzilla/show_bug.cgi?id=504

Bugzilla version 2.16.2

Comment 1

[chaduv]

This is fixed on tip. The URL added is for the 2.17.5 bug - it includes some 
bugs in the security group which we mortals cannot view; dependency tree works 
fine, and ignores bugs in groups you can't see.

justdave: does this need to be fixed in 2.16?

Comment 2

[Dave Miller [:justdave]]

If the entire tree won't display, then maybe we should.  Can you reproduce?  It
should either skip said bugs or list them as "inaccessible bug" in place of the
summary.  On the other hand, this is related to groups, and the groups stuff is
so horky prior to 2.17.1 that I'd have a hard time seeing anything like that
being a low-risk fix (and it's not a security issue since it already isn't
showing the bugs to the user).

Comment 3

[chaduv]

I can't reproduce this on 2.16 branch. I can reproduce the non-fatal
uninitialized warnings, but not the end of script error. If a user can't see a
particular bug which is a dependency in the tree they're trying to view, it (and
any bugs it depends on) are not displayed.

The non-fatal warnings are irrelvant to the bug at hand. Marking WFM.

Comment 4

[Roman Starek]

Hi all,
thanks for your patience with my bug. Ï've upgrade our bugzilla instalation to 
2.17.6 and problem disappeared. This bug could be verified and closed.