544434 - describecomponents.cgi only lists enterable products

Status: RESOLVED FIXED

(Bugzilla :: Bugzilla-General, defect)

Description

[Reed Loden [:reed]]

STR:
1. Go to https://bugzilla.mozilla.org/describecomponents.cgi
2. Notice "Mozilla Stats" product is missing
3. Go to https://bugzilla.mozilla.org/describecomponents.cgi?product=Mozilla%20Stats
4. See components for "Mozilla Stats" product

Note that the "Mozilla Stats" product currently has a group control with Default/Mandatory, ENTRY.

I think this is just a bug rather than a security issue, but it's possible that this might have some security implications...

Comment 1

[A. Shimono [:himorin]]

On 3.5.3, the product with "Default/Mandatory"
* can view in /enter_bug.cgi?classification=__all
* can view in /describecomponents.cgi
* can view in /describecomponents.cgi?product=xxxx


In the description at editproducts,
> Bugs in this product are permitted to be restricted to this group and are 
> placed in this group by default. Users who are members of this group will be 
> able to place bugs in this group. Non-members will be forced to place bugs in 
> this group on entry. 
So, I think it's not a problem that we can view in /describecomponents.cgi?product=xxxx.

Comment 2

[Frédéric Buclin]

(In reply to comment #0)
> I think this is just a bug rather than a security issue, but it's possible that
> this might have some security implications...

No, it has no security implications. The group settings are not Mandatory/Mandatory, so the product is public.

Comment 3

[Frédéric Buclin]

describecomponents.cgi should list enterable products when called from enter_bug.cgi, else it should list selectable products. Currently, it only lists enterable products, always, which is not expected when called from query.cgi or by clicking the "Browse" component.

Comment 4

[Max Kanat-Alexander]

Hmm, yeah. Maybe just making it list accessible products would be the simplest solution.

Comment 6

[Michael Ching]

Attachment: Changes get_enterable_products to get_accessible_products

Comment 7

[Marc Schumann [:Wurblzap]]

Comment on attachment 560589 [details] [diff] [review]
Changes get_enterable_products to get_accessible_products

r=Wurblzap by inspection. This does what comment 4 says.

Comment 8

[Frédéric Buclin]

I will let wurblzap commit this one. :)

Comment 9

[Marc Schumann [:Wurblzap]]

Trunk:
Committing to: bzr+ssh://[e-mail]/bugzilla/trunk/
modified describecomponents.cgi
Committed revision 8001.

Branch:
Committing to: bzr+ssh://[e-mail]/bugzilla/4.2/
modified describecomponents.cgi
Committed revision 7953.

Thanks for the patch, Michael!