309896 - The "Saved searches" tab in User Prefs can report incorrect information

Status: RESOLVED FIXED

(Bugzilla :: Query/Bug List, defect)

Description

[Frédéric Buclin]

If one of your saved searches has the same name as one of another user's saved
search, and that user uses this query for a whine, the Saved Search tab in User
Prefs says that *you* use it!?!

The culprit is User::queries which doesn't check the user ID:

    my $sth = $dbh->prepare(q{ SELECT
                             DISTINCT name, query, linkinfooter,
                                      CASE WHEN whine_queries.id 
                                      IS NOT NULL THEN 1 ELSE 0 END,
                                      UPPER(name) AS uppername 
                                 FROM namedqueries
                            LEFT JOIN whine_queries
                                   ON whine_queries.query_name = name
                                WHERE userid=?
                             ORDER BY uppername});

It should check that the whine is from the current user.

Comment 1

[A. Karl Kornel]

Attachment: Patch v1

A relatively simple patch, this includes a join with whine_events to get the
creator userid of the whine.  We then return 1 only if whine_queries.id is not
null AND the userids match.

Comment 2

[Frédéric Buclin]

Comment on attachment 197283 [details] [diff] [review]
Patch v1

>Index: User.pm

>-                                      CASE WHEN whine_queries.id 
>-                                      IS NOT NULL THEN 1 ELSE 0 END,
>+                                      CASE WHEN whine_queries.id IS NOT NULL
>+                                      AND whine_events.owner_userid = userid

This last line should not be here as it's already in the FROM clause.


>+                                      THEN 1 ELSE 0 END,
>                                       UPPER(name) AS uppername 
>                                  FROM namedqueries
>                             LEFT JOIN whine_queries
>                                    ON whine_queries.query_name = name
>+                            LEFT JOIN whine_events
>+                                   ON whine_events.owner_userid = userid

You forgot to link the whine_events and whine_queries tables.

Comment 3

[A. Karl Kornel]

Attachment: Patch v2

Swap the whine table join order and add some table names.

Comment 4

[Frédéric Buclin]

Comment on attachment 197292 [details] [diff] [review]
Patch v2

r=LpSolit

Comment 5

[Frédéric Buclin]

tip:

Checking in Bugzilla/User.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/User.pm,v  <--  User.pm
new revision: 1.84; previous revision: 1.83
done

2.20rc2:

Checking in Bugzilla/User.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/User.pm,v  <--  User.pm
new revision: 1.61.2.9; previous revision: 1.61.2.8
done