312933 - Query.cgi leaks product names

Status: RESOLVED FIXED

(Bugzilla :: Bugzilla-General, defect, P1)

Description

[Joel Peshkin]

Classification.pm populates query.cgi's bug form with a list of products even
when they are not selectable.

Comment 1

[Joel Peshkin]

This is seen in 2.21 but I believe it is in 2.20 as well.

Comment 2

[Joel Peshkin]

This does not exist on 2.20.  Only on 2.21

Comment 3

[Joel Peshkin]

Attachment: fix v1

This restricts the products listed to those the user is permitted to select. 
It also fixes the inconsistent ordering of the products.

Comment 4

[Frédéric Buclin]

Comment on attachment 200052 [details] [diff] [review]
fix v1

Classification.pm is user-independent.

Comment 5

[Frédéric Buclin]

Classification.pm is user-independent. Moreover, in query.cgi, line 299, I can read:

if (Param('useclassification')) {
    $vars->{'classification'} = $user->get_selectable_classifications;
}

User::get_selectable_classifications only returns classifications you can see.
So I see no issue here. If there is one, then it's in this method in User.pm,
not in Classification.pm.

Comment 6

[Joel Peshkin]

Since this does not effect a release version, we can drop the security flag....

this leaks through the template....
template/en/default/search/form.html.tmpl

[% FOREACH c = classification %]
prods[[% nclass FILTER js %]] = [
[%- FOREACH item = c.products %]'[% item.name FILTER js %]'[% ", " UNLESS
loop.last %] [%- END -%] ];
[% nclass = nclass+1 %]
[% END %]

which blindly polulates the structures used by the javascript code

Comment 7

[Joel Peshkin]

Attachment: keep the change to the template

Comment 8

[Frédéric Buclin]

Comment on attachment 200073 [details] [diff] [review]
keep the change to the template

r=LpSolit

Comment 9

[Joel Peshkin]

Checking in template/en/default/search/form.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/search/form.html.tmpl,v
<--  form.html.tmpl
new revision: 1.34; previous revision: 1.33
done