253088 - Users with bless permission cannot edit users

Status: RESOLVED FIXED

(Bugzilla :: Administration, task, P2)

Description

[Joel Peshkin]

When a user with bless permission but not editusers attempts to update a user,
the form variable "user" is not set.  As a result, the balance of editusers.cgi
assumes that the login_name is being changed to a blank.

Comment 1

[Joel Peshkin]

Attachment: Patch - dont wipe out user if it is not in form

Comment 2

[Joel Peshkin]

Comment on attachment 154353 [details] [diff] [review]
Patch - dont wipe out user if it is not in form

actually, there is a better way

Comment 3

[Joel Peshkin]

Attachment: patch - hide fields instead of skipping them

Comment 4

[Christian Reis]

The only difference between the two methods is that the first one is safer -- in
the obscure contrived and utterly impractical case that the user is using an
"independent" browser to access the page he may "forget" to supply the user and
then looses data.

I don't care either way, but if you go with the first approach, be sure to do
that ||=ing only if the user doesn't have editusers -- or you'll make it
impossible for an edituser-capable user to erase the name (hmm, but is that
something you want to let them do?)

Your second solution is nice because it also protects the user from erasing
description, which also uses EmitElement. 

Apply r=kiko to the patch you decide to apply, and request a2.18 as well.

Comment 5

[Christian Reis]

Talked over IRC, Joel thinks the latter is the cleaner way.

Comment 6

[Joel Peshkin]

checked in on both branches.

Note:  This should get seriously cleaned up when this is templatized

Comment 7

[Dave Miller [:justdave]]

*** Bug 266333 has been marked as a duplicate of this bug. ***

Comment 8

[Dave Miller [:justdave]]

This problem also exists in 2.16, we need this backported to the 2.16 branch. 
See bug 266333.

Comment 9

[Dave Miller [:justdave]]

Wow, believe it or not, this patch applies unmodified to Bugzilla 2.16.7. :)

Bob, care to give it a shot and let us know if it works for you?

Comment 10

[Bob Meyers]

I can confirm that the one-liner patch works in the 2.16.7 install.
Actually, I wrote that exact line, patch unseen, and was switching the hash
comment character back and forth between the lines to write out the behavior for
the bug report. Guess I should have used the time to look harder for the bug so
I wouldn't duplicate it. My bad. Good shot, all of you, and quick turnaround.
Thanks.

Comment 11

[Joel Peshkin]

Checking in editusers.cgi;
/cvsroot/mozilla/webtools/bugzilla/editusers.cgi,v  <--  editusers.cgi
new revision: 1.35.2.6; previous revision: 1.35.2.5
done

Checked in on 2.16 branch