summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDave Lawrence <dlawrence@mozilla.com>2012-10-09 21:01:58 +0200
committerDave Lawrence <dlawrence@mozilla.com>2012-10-09 21:01:58 +0200
commitb0f9f0819ceaeefa2ed2b4ba028d851d1de6146b (patch)
tree42c25087002db6cbec187a8f8d6ad111589107df
parentfca7f7eda42cecf08252d710a16c4ad001ba204b (diff)
parentf9e41025a332f57b3d9cabed8418e208fbd90400 (diff)
downloadbugzilla-b0f9f0819ceaeefa2ed2b4ba028d851d1de6146b.tar.gz
bugzilla-b0f9f0819ceaeefa2ed2b4ba028d851d1de6146b.tar.xz
merged with bugzilla/4.2
-rw-r--r--Bugzilla/Bug.pm10
-rw-r--r--Bugzilla/DB/Mysql.pm2
-rw-r--r--Bugzilla/DB/Schema.pm5
-rw-r--r--Bugzilla/Group.pm4
-rw-r--r--Bugzilla/Search.pm16
-rwxr-xr-xbuglist.cgi1
-rw-r--r--extensions/OldBugMove/Extension.pm4
-rw-r--r--extensions/Voting/Config.pm33
-rw-r--r--extensions/Voting/Extension.pm1
-rwxr-xr-xprocess_bug.cgi2
-rwxr-xr-xreport.cgi13
-rw-r--r--template/en/default/filterexceptions.pl1
-rw-r--r--template/en/default/reports/report.html.tmpl2
13 files changed, 74 insertions, 20 deletions
diff --git a/Bugzilla/Bug.pm b/Bugzilla/Bug.pm
index dcf85d206..68ba98549 100644
--- a/Bugzilla/Bug.pm
+++ b/Bugzilla/Bug.pm
@@ -2891,7 +2891,8 @@ sub add_see_also {
# ref bug id for sending changes email.
my $ref_bug = delete $field_values->{ref_bug};
if ($class->isa('Bugzilla::BugUrl::Bugzilla::Local')
- and !$skip_recursion)
+ and !$skip_recursion
+ and $ref_bug->check_can_change_field('see_also', '', $self->id, \$privs))
{
$ref_bug->add_see_also($self->id, 'skip_recursion');
push @{ $self->{_update_ref_bugs} }, $ref_bug;
@@ -2923,12 +2924,15 @@ sub remove_see_also {
# we need to notify changes for that bug too.
$removed_bug_url = $removed_bug_url->[0];
if (!$skip_recursion and $removed_bug_url
- and $removed_bug_url->isa('Bugzilla::BugUrl::Bugzilla::Local'))
+ and $removed_bug_url->isa('Bugzilla::BugUrl::Bugzilla::Local')
+ and $removed_bug_url->ref_bug_url)
{
my $ref_bug
= Bugzilla::Bug->check($removed_bug_url->ref_bug_url->bug_id);
- if (Bugzilla->user->can_edit_product($ref_bug->product_id)) {
+ if (Bugzilla->user->can_edit_product($ref_bug->product_id)
+ and $ref_bug->check_can_change_field('see_also', $self->id, '', \$privs))
+ {
my $self_url = $removed_bug_url->local_uri($self->id);
$ref_bug->remove_see_also($self_url, 'skip_recursion');
push @{ $self->{_update_ref_bugs} }, $ref_bug;
diff --git a/Bugzilla/DB/Mysql.pm b/Bugzilla/DB/Mysql.pm
index 06bf3d8df..fad175eac 100644
--- a/Bugzilla/DB/Mysql.pm
+++ b/Bugzilla/DB/Mysql.pm
@@ -941,7 +941,9 @@ sub _bz_raw_column_info {
$index = name of an index
Returns: An abstract index definition, always in hashref format.
If the index does not exist, the function returns undef.
+
=cut
+
sub bz_index_info_real {
my ($self, $table, $index) = @_;
diff --git a/Bugzilla/DB/Schema.pm b/Bugzilla/DB/Schema.pm
index 6dd78d206..23e484464 100644
--- a/Bugzilla/DB/Schema.pm
+++ b/Bugzilla/DB/Schema.pm
@@ -1864,6 +1864,7 @@ C<ALTER TABLE> SQL statement
sub get_fk_ddl {
+
=item C<_get_fk_ddl>
=over
@@ -1877,7 +1878,9 @@ Protected method. Translates the C<REFERENCES> item of a column into SQL.
=over
=item C<$table> - The name of the table the reference is from.
+
=item C<$column> - The name of the column the reference is from
+
=item C<$references> - The C<REFERENCES> hashref from a column.
=back
@@ -1978,6 +1981,7 @@ Converts a TYPE from the L</ABSTRACT_SCHEMA> format into the real SQL type.
}
sub get_column {
+
=item C<get_column($table, $column)>
Description: Public method to get the abstract definition of a column.
@@ -2843,6 +2847,7 @@ sub serialize_abstract {
in the same fashion as) the current version of Schema.
However, it will represent the serialized data instead of
ABSTRACT_SCHEMA.
+
=cut
sub deserialize_abstract {
diff --git a/Bugzilla/Group.pm b/Bugzilla/Group.pm
index 3f521d0f2..109f06d7f 100644
--- a/Bugzilla/Group.pm
+++ b/Bugzilla/Group.pm
@@ -190,7 +190,9 @@ sub check_members_are_visible {
my $self = shift;
my $user = Bugzilla->user;
return if !Bugzilla->params->{'usevisibilitygroups'};
- my $is_visible = grep { $_->id == $_ } @{ $user->visible_groups_inherited };
+
+ my $group_id = $self->id;
+ my $is_visible = grep { $_ == $group_id } @{ $user->visible_groups_inherited };
if (!$is_visible) {
ThrowUserError('group_not_visible', { group => $self });
}
diff --git a/Bugzilla/Search.pm b/Bugzilla/Search.pm
index a4db2e05d..c7c5038be 100644
--- a/Bugzilla/Search.pm
+++ b/Bugzilla/Search.pm
@@ -2050,8 +2050,8 @@ sub _contact_pronoun {
my ($self, $args) = @_;
my $value = $args->{value};
my $user = $self->_user;
-
- if ($value =~ /^\%group/) {
+
+ if ($value =~ /^\%group\.[^%]+%$/) {
$self->_contact_exact_group($args);
}
elsif ($value =~ /^(%\w+%)$/) {
@@ -2068,11 +2068,17 @@ sub _contact_exact_group {
my $dbh = Bugzilla->dbh;
my $user = $self->_user;
+ # We already know $value will match this regexp, else we wouldn't be here.
$value =~ /\%group\.([^%]+)%/;
- my $group = Bugzilla::Group->check({ name => $1, _error => 'invalid_group_name' });
- $group->check_members_are_visible();
+ my $group_name = $1;
+ my $group = Bugzilla::Group->check({ name => $group_name, _error => 'invalid_group_name' });
+ # Pass $group_name instead of $group->name to the error message
+ # to not leak the existence of the group.
$user->in_group($group)
- || ThrowUserError('invalid_group_name', {name => $group->name});
+ || ThrowUserError('invalid_group_name', { name => $group_name });
+ # Now that we know the user belongs to this group, it's safe
+ # to disclose more information.
+ $group->check_members_are_visible();
my $group_ids = Bugzilla::Group->flatten_group_membership($group->id);
my $table = "user_group_map_$chart_id";
diff --git a/buglist.cgi b/buglist.cgi
index 891fd66b4..e3c56cd24 100755
--- a/buglist.cgi
+++ b/buglist.cgi
@@ -65,7 +65,6 @@ my $buffer = $cgi->query_string();
my $user = Bugzilla->login();
if (length($buffer) == 0) {
- print $cgi->header(-refresh=> '10; URL=query.cgi');
ThrowUserError("buglist_parameters_required");
}
diff --git a/extensions/OldBugMove/Extension.pm b/extensions/OldBugMove/Extension.pm
index b12d36a9a..d1b953748 100644
--- a/extensions/OldBugMove/Extension.pm
+++ b/extensions/OldBugMove/Extension.pm
@@ -132,7 +132,9 @@ sub _check_bug_resolution {
my $original_validator = shift;
my ($invocant, $resolution) = @_;
- if ($resolution eq 'MOVED' and !Bugzilla->input_params->{'oldbugmove'}) {
+ if ($resolution eq 'MOVED' && $invocant->resolution ne 'MOVED'
+ && !Bugzilla->input_params->{'oldbugmove'})
+ {
# MOVED has a special meaning and can only be used when
# really moving bugs to another installation.
ThrowUserError('oldbugmove_no_manual_move');
diff --git a/extensions/Voting/Config.pm b/extensions/Voting/Config.pm
new file mode 100644
index 000000000..438f1e054
--- /dev/null
+++ b/extensions/Voting/Config.pm
@@ -0,0 +1,33 @@
+# -*- Mode: perl; indent-tabs-mode: nil -*-
+#
+# The contents of this file are subject to the Mozilla Public
+# License Version 1.1 (the "License"); you may not use this file
+# except in compliance with the License. You may obtain a copy of
+# the License at http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS
+# IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
+# implied. See the License for the specific language governing
+# rights and limitations under the License.
+#
+# The Original Code is the Bugzilla Bug Tracking System.
+#
+# The Initial Developer of the Original Code is Frédéric Buclin.
+# Portions created by the Initial Developer is Copyright (C) 2012 the
+# Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+# Frédéric Buclin <LpSolit@gmail.com>
+
+package Bugzilla::Extension::Voting;
+use strict;
+
+use constant NAME => 'Voting';
+
+use constant REQUIRED_MODULES => [
+];
+
+use constant OPTIONAL_MODULES => [
+];
+
+__PACKAGE__->NAME;
diff --git a/extensions/Voting/Extension.pm b/extensions/Voting/Extension.pm
index 3fb799bbf..b8763b4df 100644
--- a/extensions/Voting/Extension.pm
+++ b/extensions/Voting/Extension.pm
@@ -40,7 +40,6 @@ use Bugzilla::Token;
use List::Util qw(min);
-use constant NAME => 'Voting';
use constant VERSION => BUGZILLA_VERSION;
use constant DEFAULT_VOTES_PER_BUG => 1;
# These came from Bugzilla itself, so they maintain the old numbers
diff --git a/process_bug.cgi b/process_bug.cgi
index 8d2464a27..e5461e962 100755
--- a/process_bug.cgi
+++ b/process_bug.cgi
@@ -303,7 +303,7 @@ foreach my $dep_field (qw(dependson blocked)) {
if (should_set($dep_field)) {
if (my $dep_action = $cgi->param("${dep_field}_action")) {
$set_all_fields{$dep_field}->{$dep_action} =
- [split(/\s,/, $cgi->param($dep_field))];
+ [split(/[\s,]+/, $cgi->param($dep_field))];
}
else {
$set_all_fields{$dep_field}->{set} = $cgi->param($dep_field);
diff --git a/report.cgi b/report.cgi
index 1ec3ac864..cc43e66e4 100755
--- a/report.cgi
+++ b/report.cgi
@@ -84,10 +84,12 @@ if (defined($height)) {
$height <= 2000 || ThrowUserError("chart_too_large");
}
+my $formatparam = $cgi->param('format') || '';
+
# These shenanigans are necessary to make sure that both vertical and
# horizontal 1D tables convert to the correct dimension when you ask to
# display them as some sort of chart.
-if (defined $cgi->param('format') && $cgi->param('format') eq "table") {
+if ($formatparam eq "table") {
if ($col_field && !$row_field) {
# 1D *tables* should be displayed vertically (with a row_field only)
$row_field = $col_field;
@@ -210,7 +212,7 @@ $vars->{'row_names'} = \@row_names;
$vars->{'tbl_names'} = \@tbl_names;
# Below a certain width, we don't see any bars, so there needs to be a minimum.
-if ($width && $cgi->param('format') eq "bar") {
+if ($width && $formatparam eq "bar") {
my $min_width = (scalar(@col_names) || 1) * 20;
if (!$cgi->param('cumulate')) {
@@ -226,8 +228,6 @@ $vars->{'height'} = $height if $height;
$vars->{'query'} = $query;
$vars->{'debug'} = $cgi->param('debug');
-my $formatparam = $cgi->param('format');
-
if ($action eq "wrap") {
# So which template are we using? If action is "wrap", we will be using
# no format (it gets passed through to be the format of the actual data),
@@ -236,7 +236,6 @@ if ($action eq "wrap") {
# data, or images generated by calling report.cgi again with action as
# "plot".
$formatparam =~ s/[^a-zA-Z\-]//g;
- trick_taint($formatparam);
$vars->{'format'} = $formatparam;
$formatparam = '';
@@ -305,6 +304,10 @@ $template->process("$format->{'template'}", $vars)
sub get_names {
my ($names, $isnumeric, $field_name) = @_;
my ($field, @sorted);
+ # XXX - This is a hack to handle the actual_time/work_time field,
+ # because it's named 'actual_time' in Search.pm but 'work_time' in Field.pm.
+ $_[2] = $field_name = 'work_time' if $field_name eq 'actual_time';
+
# _realname fields aren't real Bugzilla::Field objects, but they are a
# valid axis, so we don't vailidate them as Bugzilla::Field objects.
$field = Bugzilla::Field->check($field_name)
diff --git a/template/en/default/filterexceptions.pl b/template/en/default/filterexceptions.pl
index dfa1083bd..917dc85ae 100644
--- a/template/en/default/filterexceptions.pl
+++ b/template/en/default/filterexceptions.pl
@@ -105,7 +105,6 @@
'other_format.name',
'sizeurl',
'switchbase',
- 'format',
'cumulate',
],
diff --git a/template/en/default/reports/report.html.tmpl b/template/en/default/reports/report.html.tmpl
index d4c9d4043..94725ae81 100644
--- a/template/en/default/reports/report.html.tmpl
+++ b/template/en/default/reports/report.html.tmpl
@@ -170,7 +170,7 @@
this report</a>
[% ELSE %]
<a href="query.cgi?[% switchbase %]&amp;chart_format=
- [% format %]&amp;format=report-graph&amp;cumulate=[% cumulate %]">
+ [% format FILTER uri %]&amp;format=report-graph&amp;cumulate=[% cumulate %]">
Edit this report
</a>
[% END %]