Closed
Bug 234825
Opened 21 years ago
Closed 20 years ago
duplicates.cgi reveals products user doesnt have access to
Categories
(Bugzilla :: Reporting/Charting, defect, P2)
Bugzilla
Reporting/Charting
Tracking
()
RESOLVED
FIXED
Bugzilla 2.16
People
(Reporter: gmillerd, Assigned: bugreport)
Details
(Whiteboard: [fixed in 2.16.6] [fixed in 2.18rc1])
Attachments
(2 files)
773 bytes,
patch
|
justdave
:
review+
|
Details | Diff | Splinter Review |
602 bytes,
patch
|
justdave
:
review+
|
Details | Diff | Splinter Review |
User-Agent:
Build Identifier:
the line near 272 in duplicates v1.41:
$vars->{'products'} = \@::legal_product;
... should be something akin to ...
{
my @tmp;
foreach my $p (@::legal_product) {
if (CanEnterProduct($p)) {
push(@tmp, $p);
}
}
$vars->{'products'} = \@tmp;
}
Reproducible: Always
Steps to Reproduce:
visit duplicates.cgi
Actual Results:
all products in the system
Expected Results:
only products i have access to
Comment 2•21 years ago
|
||
Nominating for 2.18rc1 (shouldn't we be using flags?), because we seem to be
fixing other bugs like this at the moment.
Gerv
Whiteboard: [wanted for 2.18rc1]?
Comment 3•21 years ago
|
||
Confirming; I suspect Unconfirmed security bugs aren't on Dave's radar.
Gerv
Status: UNCONFIRMED → NEW
Ever confirmed: true
Comment 4•21 years ago
|
||
Gerv: since you're confirming this, I assume you've reproduced it?
Assignee | ||
Comment 5•21 years ago
|
||
This effects the 2.16 branch as well
Assignee | ||
Comment 6•21 years ago
|
||
Assignee | ||
Updated•21 years ago
|
Attachment #143896 -
Flags: review?(justdave)
Assignee | ||
Comment 7•21 years ago
|
||
Assignee | ||
Updated•21 years ago
|
Attachment #143897 -
Flags: review?(justdave)
Assignee | ||
Updated•21 years ago
|
Severity: normal → major
OS: Windows XP → All
Priority: -- → P2
Hardware: PC → All
Whiteboard: [wanted for 2.18rc1]? → [wanted for 2.16.6][wanted for 2.18rc1]
Target Milestone: --- → Bugzilla 2.18
Updated•21 years ago
|
Whiteboard: [wanted for 2.16.6][wanted for 2.18rc1] → [wanted for 2.16.6] [wanted for 2.18rc1]
Updated•21 years ago
|
Assignee: gerv → bugreport
Updated•21 years ago
|
Flags: blocking2.18+
Flags: blocking2.16.6+
Target Milestone: Bugzilla 2.18 → Bugzilla 2.16
Updated•21 years ago
|
Attachment #143896 -
Flags: review?(justdave) → review+
Comment 8•21 years ago
|
||
Comment on attachment 143897 [details] [diff] [review]
Patch for 2.18
>+my @selectable_products = GetSelectableProducts();
>+$vars->{'products'} = \@selectable_products;
This works, so I won't complain, but wouldn't it save an unnecessary variable
if you do it like this:
$vars->{'products'} = [ GetSelectableProducts() ];
?
Attachment #143897 -
Flags: review?(justdave) → review+
Comment 9•21 years ago
|
||
holding approval for security advisory
Flags: approval?
Flags: approval2.16?
Whiteboard: [wanted for 2.16.6] [wanted for 2.18rc1] → [ready for 2.16.6] [ready for 2.18rc1]
Assignee | ||
Comment 10•21 years ago
|
||
Proposed wording for release notes:
Duplicates.cgi can divulge the names of products to which the user is not
supposed to have any access.
Updated•20 years ago
|
Flags: approval2.16? → approval2.16+
Updated•20 years ago
|
Flags: approval? → approval+
Assignee | ||
Comment 11•20 years ago
|
||
checked in on both branches
Status: NEW → RESOLVED
Closed: 20 years ago
Resolution: --- → FIXED
Assignee | ||
Updated•20 years ago
|
Whiteboard: [ready for 2.16.6] [ready for 2.18rc1] → [fixed in 2.16.6] [fixed in 2.18rc1]
Updated•12 years ago
|
QA Contact: matty_is_a_geek → default-qa
You need to log in
before you can comment on or make changes to this bug.
Description
•