825718 - Bugzilla::Bug->check() doesn't support the new caching mechanism

Status: RESOLVED FIXED

(Bugzilla :: Bugzilla-General, defect)

Description

[Frédéric Buclin]

Try to access a bug you are not allowed to see. You get the following error message:

  You are not authorized to access bug #HASH(0x9915b38).

That's because Bugzilla::Bug->check() doesn't support the new caching mechanism implemented in bug 811280. It still expects to get a scalar (either bug id or alias), not a hash.

Comment 1

[:glob ✱]

Attachment: patch v1

Comment 2

[Frédéric Buclin]

Comment on attachment 697095 [details] [diff] [review]
patch v1

>=== modified file 'Bugzilla/Bug.pm'

>-    ThrowUserError('improper_bug_id_field_value', { field => $field }) unless defined $id;
>+    ThrowUserError('improper_bug_id_field_value', { field => $field }) unless defined $param;

What must really be tested is if a bug ID has been passed or not. Because if $param is {id => undef, cache => 1}, then this error would no longer be thrown, because $param itself exists, but with no bug ID defined. That's a regression. So this check must be moved after $id is set below.


>+    if (ref($param)) {
>+        $param->{id} = trim($param->{id});
>+        $id = $param->{id};

You can simply write: $id = $param->{id} = trim($param->{id}); on a single line.


>+    } else {
>+        $param = trim($param);
>+        $id = $param;

Same here: $id = $param = trim($param);


>+    my $self = $class->new($param);

The error above should come right before this call, now that we have $id in hands.


r=LpSolit with these comments fixed.

Comment 3

[:glob ✱]

Committing to: bzr+ssh://[e-mail]/bugzilla/trunk/
modified Bugzilla/Bug.pm
Committed revision 8549.