Bug 926952: Possible race conditions when editing or deleting a milestone or a version

r/a=glob

2 files changed, 14 insertions, 3 deletions

diff --git a/Bugzilla/Milestone.pm b/Bugzilla/Milestone.pm
index 4f262fd2e..6d6465e4d 100644
--- a/Bugzilla/Milestone.pm
+++ b/Bugzilla/Milestone.pm
@@ -98,10 +98,12 @@ sub run_create_validators {
 
 sub update {
     my $self = shift;
+    my $dbh = Bugzilla->dbh;
+
+    $dbh->bz_start_transaction();
     my $changes = $self->SUPER::update(@_);
 
     if (exists $changes->{value}) {
-        my $dbh = Bugzilla->dbh;
         # The milestone value is stored in the bugs table instead of its ID.
         $dbh->do('UPDATE bugs SET target_milestone = ?
                   WHERE target_milestone = ? AND product_id = ?',
@@ -112,6 +114,8 @@ sub update {
                   WHERE id = ? AND defaultmilestone = ?',
                  undef, ($self->name, $self->product_id, $changes->{value}->[0]));
     }
+    $dbh->bz_commit_transaction();
+
     return $changes;
 }
 
@@ -119,6 +123,8 @@ sub remove_from_db {
     my $self = shift;
     my $dbh = Bugzilla->dbh;
 
+    $dbh->bz_start_transaction();
+
     # The default milestone cannot be deleted.
     if ($self->name eq $self->product->default_milestone) {
         ThrowUserError('milestone_is_default', { milestone => $self });
@@ -147,8 +153,9 @@ sub remove_from_db {
                              Bugzilla->user->id, $timestamp);
         }
     }
-
     $self->SUPER::remove_from_db();
+
+    $dbh->bz_commit_transaction();
 }
 
 ################################
diff --git a/Bugzilla/Version.pm b/Bugzilla/Version.pm
index 317b73d95..1dcd2b141 100644
--- a/Bugzilla/Version.pm
+++ b/Bugzilla/Version.pm
@@ -118,14 +118,18 @@ sub bug_count {
 
 sub update {
     my $self = shift;
+    my $dbh = Bugzilla->dbh;
+
+    $dbh->bz_start_transaction();
     my ($changes, $old_self) = $self->SUPER::update(@_);
 
     if (exists $changes->{value}) {
-        my $dbh = Bugzilla->dbh;
         $dbh->do('UPDATE bugs SET version = ?
                   WHERE version = ? AND product_id = ?',
                   undef, ($self->name, $old_self->name, $self->product_id));
     }
+    $dbh->bz_commit_transaction();
+
     return $changes;
 }