summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorByron Jones <glob@mozilla.com>2015-05-08 07:28:22 +0200
committerByron Jones <glob@mozilla.com>2015-05-08 07:28:22 +0200
commita7a5da901f048d696582c3e6d4b67aee0d91f3d2 (patch)
tree8d2f9c35a0f98d37650d80020b4ed5dd52629a31
parent54fb248d58c8db0082c4d034912c325ae0d0acaf (diff)
downloadbugzilla-a7a5da901f048d696582c3e6d4b67aee0d91f3d2.tar.gz
bugzilla-a7a5da901f048d696582c3e6d4b67aee0d91f3d2.tar.xz
Bug 1149055: flag requestees are unable to set an attachment flag via a the update_attachment webservice if they do not have editbugs
-rw-r--r--Bugzilla/WebService/Bug.pm33
1 files changed, 27 insertions, 6 deletions
diff --git a/Bugzilla/WebService/Bug.pm b/Bugzilla/WebService/Bug.pm
index 9491a7938..b76c30b19 100644
--- a/Bugzilla/WebService/Bug.pm
+++ b/Bugzilla/WebService/Bug.pm
@@ -953,8 +953,6 @@ sub update_attachment {
|| ThrowUserError("invalid_attach_id", { attach_id => $id });
my $bug = $attachment->bug;
$attachment->_check_bug;
- $attachment->validate_can_edit
- || ThrowUserError("illegal_attachment_edit", { attach_id => $id });
push @attachments, $attachment;
$bugs{$bug->id} = $bug;
@@ -965,10 +963,33 @@ sub update_attachment {
# Update the values
foreach my $attachment (@attachments) {
- $attachment->set_all($params);
- if ($flags) {
- my ($old_flags, $new_flags) = extract_flags($flags, $attachment->bug, $attachment);
- $attachment->set_flags($old_flags, $new_flags);
+ my ($update_flags, $new_flags) = $flags
+ ? extract_flags($flags, $attachment->bug, $attachment)
+ : ([], []);
+ if ($attachment->validate_can_edit) {
+ $attachment->set_all($params);
+ $attachment->set_flags($update_flags, $new_flags) if $flags;
+ }
+ elsif (scalar @$update_flags && !scalar(@$new_flags) && !scalar keys %$params) {
+ # Requestees can set flags targetted to them, even if they cannot
+ # edit the attachment. Flag setters can edit their own flags too.
+ my %flag_list = map { $_->{id} => $_ } @$update_flags;
+ my $flag_objs = Bugzilla::Flag->new_from_list([ keys %flag_list ]);
+ my @editable_flags;
+ foreach my $flag_obj (@$flag_objs) {
+ if ($flag_obj->setter_id == $user->id
+ || ($flag_obj->requestee_id && $flag_obj->requestee_id == $user->id))
+ {
+ push(@editable_flags, $flag_list{$flag_obj->id});
+ }
+ }
+ if (!scalar @editable_flags) {
+ ThrowUserError("illegal_attachment_edit", { attach_id => $attachment->id });
+ }
+ $attachment->set_flags(\@editable_flags, []);
+ }
+ else {
+ ThrowUserError("illegal_attachment_edit", { attach_id => $attachment->id });
}
}