summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorlpsolit%gmail.com <>2007-08-23 22:41:22 +0200
committerlpsolit%gmail.com <>2007-08-23 22:41:22 +0200
commitcda6e20b9ab268a042b51f9ef868849c1da62d98 (patch)
tree576e26bd5ba662b42afdef63f71a2213fa8a102f
parent63e7d4ae05d9eeff9a7d8a2613d8b70012d036fa (diff)
downloadbugzilla-cda6e20b9ab268a042b51f9ef868849c1da62d98.tar.gz
bugzilla-cda6e20b9ab268a042b51f9ef868849c1da62d98.tar.xz
Bug 382056: [SECURITY] Bugzilla::Webservice::Bug->get_bugs() doesn't check if the user is in the timetracking group when returning data - Patch by Frédéric Buclin <LpSolit@gmail.com> r=mkanat a=LpSolit
-rwxr-xr-xBugzilla/WebService/Bug.pm7
1 files changed, 7 insertions, 0 deletions
diff --git a/Bugzilla/WebService/Bug.pm b/Bugzilla/WebService/Bug.pm
index a2710c482..14ed2e7fd 100755
--- a/Bugzilla/WebService/Bug.pm
+++ b/Bugzilla/WebService/Bug.pm
@@ -70,6 +70,13 @@ sub get_bugs {
ValidateBugID($bug_id);
my $bug = new Bugzilla::Bug($bug_id);
+ # Timetracking fields are deleted if the user doesn't belong to
+ # the corresponding group.
+ unless (Bugzilla->user->in_group(Bugzilla->params->{'timetrackinggroup'})) {
+ delete $bug->{'estimated_time'};
+ delete $bug->{'remaining_time'};
+ delete $bug->{'deadline'};
+ }
# This is done in this fashion in order to produce a stable API.
# The internals of Bugzilla::Bug are not stable enough to just
# return them directly.