261303 - add/delete keywords before checking user's authorization to change field

Status: RESOLVED WORKSFORME

(Bugzilla :: Creating/Changing Bugs, defect)

Description

[Myk Melez [:myk] [@mykmelez]]

Per bug 252638, comment 10, a more robust way of authorizing users to edit
keywords that might plug some unknown security holes and make it more difficult
to accidentally expose others would be to do all the adding/deleting of keywords
before we reach CheckCanChangeField (when users add or delete keywords instead
of setting keywords to an exact value) so that by the time we authorize the
change we are just setting keywords to an exact value don't have to make a funky
CheckCanChangeField call for this special case.

Marking secure and making depend on bug 252638 until that bug goes public, after
which this bug can be made public as well and its dependency on that bug broken.

Comment 1

[Dave Miller [:justdave]]

(In reply to comment #0)
> Marking secure and making depend on bug 252638 until that bug goes public, after
> which this bug can be made public as well and its dependency on that bug broken.

Advisory for bug 252638 has posted.  Clearing security flag and clearing dependency.

Comment 2

[Frédéric Buclin]

$bug->modify_keywords() handles all this correctly and calls check_can_change_field() itself if it detects any change.