311281 - describecomponents.cgi shows selectable products, but denies based on "enterable"

Status: RESOLVED DUPLICATE of bug 153461

(Bugzilla :: Bugzilla-General, defect)

Description

[Max Kanat-Alexander]

In describecomponents.cgi, if you access it without specifying a product, it
shows a list of products. These are the list of *selectable* products.

If you try to then click on a product that is not *enterable*, you get the error:

"The product [blah] does not exist or you don't have access to it. The following
is a list of the products you can choose from."

You can see this on landfill with the "Another Product" product.

Comment 1

[Frédéric Buclin]

This is a problem I discussed with joel on IRC a few days ago. We came to the
conclusion that selectable products should include all enterable products. This
file needs some rewrite anyway, see bug 311422.

Comment 2

[Frédéric Buclin]

err... wait. Unless I'm wrong, describecomponents.cgi only shows products you
can enter bugs into, even when called from query.cgi (which is what I was
talking about in my previous comment). If you applied your patch from bug
311278, then that's a bug in your patch, not in the actual code. Indeed, you wrote:

my @products = @{$user->get_selectable_products()};

instead of:

my @products = @{$user->get_enterable_products()};

which will be defined in bug 306325.

Comment 3

[GavinS]

I'm pretty sure I've seen this problem on an unpatched BZ (where
describecomponents.cgi does list a product which gives you an access-error when
you click on it)

Comment 4

[Max Kanat-Alexander]

Yep, I discovered this problem on an unpatched BZ. Just try landfill. As I said,
the "Another Product" product will demonstrate the problem on 2.20.

Comment 5

[Max Kanat-Alexander]

(In reply to comment #1)
> We came to the
> conclusion that selectable products should include all enterable products.

  I don't really understand what you mean by that, by the way. Many products can
be *searched* which are not *enterable*. And for that, you need them listed and
visible in describecomponents.cgi, because it's linked from query.cgi as well as
from enter_bug.

Comment 6

[Frédéric Buclin]

*** Bug 339679 has been marked as a duplicate of this bug. ***

Comment 7

[timeless]

Attachment: is this all it takes?

Comment 8

[Frédéric Buclin]

(In reply to comment #7)
> is this all it takes?

Not sure. Actually, enterable products are not necessarily a subset of selectable products, and so this patch could hide some enterable products. Maybe should we check which script is the caller and display corresponding products accordingly.

Comment 9

[Max Kanat-Alexander]

The script should show the union of get_selectable_products and get_enterable_products.

I think there might even be a "union" function in List::Util.

Comment 10

[Frédéric Buclin]

(In reply to comment #9)
> The script should show the union of get_selectable_products and
> get_enterable_products.

This would be confusing. Assuming you try to enter a new bug, you should only see products you can enter bugs into. Else you would see products for which you are not allowed to enter bugs into and would say "hey, so why are they listed??".

Comment 11

[Frédéric Buclin]

Comment on attachment 223810 [details] [diff] [review]
is this all it takes?

r- per my previous comment.

Comment 12

[timeless]

i'm appealing. if you want describecomponents to include an annotation "Closed for bug entry" or similar, that's fine, i'll even do it. but this sucks. i don't like being bounced around, not by lame cgis and certainly not by conflicting reviewers.

Comment 13

[Frédéric Buclin]

(In reply to comment #12)
> i'm appealing. if you want describecomponents to include an annotation "Closed
> for bug entry" or similar, that's fine, i'll even do it.

Sounds like a good idea! I would r+ this.

Comment 14

[Max Kanat-Alexander]

(In reply to comment #10)
> This would be confusing. Assuming you try to enter a new bug, you should only
> see products you can enter bugs into. 

  No, because describecomponents shows *components* when linked from that page. You almost never see the list of products. Nobody would be confused. You almost never see the product *list* of describecomponents, but you do need to be able to see the components of a given product from anywhere.

Comment 15

[Frédéric Buclin]

Fixed by bug 153461 (and I cannot reproduce on tip).