233502 - Query.cgi displays bugs for the product for which user with restricted permissions

Status: RESOLVED WORKSFORME

(Bugzilla :: Query/Bug List, defect)

Description

[Max]

User-Agent:       
Build Identifier: 

In the page query.cgi:
-if I have a user that he doesn't have a permissions for to see all the 
products 
-No select any project in the Product list
-In the parameters the "Userbuggroups" is ON

If I perform the Query the result is that this user can to see all the bugs 
relevant all the project present in the Product list. Instead of I select the 
project where this user has the permission the query works correctly

Reproducible: Always
Steps to Reproduce:
1.Create a user with the permission for to see only one project(in the product 
list you must have more that one project
2.the parameters "Userbuggroups" is ON
3.Perform a query without to select anything in the list "product"

Actual Results:  
I can see the bugs relevant all the project present in the databases

Expected Results:  
The user can see only the bugs relevant the project where he has the permission

I see that probebily in the Development version of Bugzilla is fixed ( if it is 
the number 209742;It seems similar) I've the version 2.16.4.Is it possibile to 
have the fix relevant this bug?Please, it is important for us.

Comment 1

[Vlad Dascalu]

Unconfirmed security bug - turning on security flag until resolved as invalid or
fixed.

Comment 2

[Vlad Dascalu]

(or probably this is a dupe, have you tried upgrading to 2.16.5 in case it got
fixed before?)

Comment 3

[Vlad Dascalu]

Making bug number clickable from initial report: bug 209742.

Comment 4

[Dave Miller [:justdave]]

Security issue, CCing the usual suspects.

Note that this is 2.16.x.  Bug 209742 can not possibly be related (as suggested
in the original description) since that bug was on the new group architecture,
and groups have been completely rewritten since 2.16.x.

There is no 2.16.5 yet (there will be soon), and there were no group security
items fixed in it anyway.

Comment 5

[Gervase Markham [:gerv]]

Dave: have you confirmed this issue?

Gerv

Comment 6

[Dave Miller [:justdave]]

No, I haven't (which is why it's still UNCONFIRMED).  The only place I have a
2.16 install to play with is landfill, and I haven't had a chance to get in
there and play yet.

Comment 7

[Joel Peshkin]

Nope.  Can't make this happen.  

Comment 8

[Dave Miller [:justdave]]

I can't either....

Max: do you have groups defined for the products which are showing up which you
think shouldn't be?  Turning on usebuggroups doesn't automatically create groups
for existing products.

Comment 9

[Max]

Yes, I defined the groups  for the products which are showing up which you
think shouldn't be. In fact if in the Product list you select a project the 
query works correctly. The user with restrict permission can to see only the 
bugs relevant his Product. But if the USER doesn't select nothing and he 
perform the query (thereafter without filter in the product list)he can to see 
the bugs relevant all products present in the database. Let it me know if 
something is not clear.

Comment 10

[Dave Miller [:justdave]]

But you added the groups after the fact, right?  Adding a group that matches a
product (in 2.16 anyway - this isn't an issue in 2.17.x) does not automatically
add all the bugs in that product to the group.  You'll need to run a query which
returns all bugs in the product, then click the "change several bugs at one"
link, then set the group radio buttons to add that group to all of those bugs.

Comment 11

[Dave Miller [:justdave]]

Max: any reply to comment 10?  Did adding groups to those bugs fix it?

Comment 12

[Gervase Markham [:gerv]]

[e-mail]: hello? Any news?

Gerv

Comment 13

[Dave Miller [:justdave]]

Gerv: see comment 6.  This wasn't confirmable yet.

Comment 14

[Dave Miller [:justdave]]

no response from reporter, and we have a logical explanation for it (groups were
added after the fact, and the bugs didn't get added to the groups).

Leaving secured to give the reporter a chance to confirm/deny, but I will remove
the security flag in one week if there's no further response from the reporter.