Fixed very very nasty bug which, when deleting a component, would tell

you it had no bugs (even when it had some), and would then proceed to
delete all those bugs (even if you had the param set to never allow
bug deletion.)  Added some paranoia to prevent such things from
happening again.  Yikes.

1 files changed, 16 insertions, 11 deletions

diff --git a/editproducts.cgi b/editproducts.cgi
index 0b90c3d62..5e54813a2 100755
--- a/editproducts.cgi
+++ b/editproducts.cgi
@@ -443,27 +443,32 @@ if ($action eq 'delete') {
     # so I have to iterate over bugs and delete all the indivial entries
     # in bugs_activies and attachments.
 
-    SendSQL("SELECT bug_id
+    if (Param("allowbugdeletion")) {
+        SendSQL("SELECT bug_id
              FROM bugs
              WHERE product=" . SqlQuote($product));
-    while (MoreSQLData()) {
-        my $bugid = FetchOneColumn();
+        while (MoreSQLData()) {
+            my $bugid = FetchOneColumn();
 
-        my $query = $::db->query("DELETE FROM attachments WHERE bug_id=$bugid")
+            my $query =
+                $::db->query("DELETE FROM attachments WHERE bug_id=$bugid")
                 or die "$::db_errstr";
-        $query = $::db->query("DELETE FROM bugs_activity WHERE bug_id=$bugid")
+            $query =
+                $::db->query("DELETE FROM bugs_activity WHERE bug_id=$bugid")
                 or die "$::db_errstr";
-        $query = $::db->query("DELETE FROM dependencies WHERE blocked=$bugid")
+            $query =
+                $::db->query("DELETE FROM dependencies WHERE blocked=$bugid")
                 or die "$::db_errstr";
-    }
-    print "Attachments, bug activity and dependencies deleted.<BR>\n";
+        }
+        print "Attachments, bug activity and dependencies deleted.<BR>\n";
 
 
-    # Deleting the rest is easier:
+        # Deleting the rest is easier:
 
-    SendSQL("DELETE FROM bugs
+        SendSQL("DELETE FROM bugs
              WHERE product=" . SqlQuote($product));
-    print "Bugs deleted.<BR>\n";
+        print "Bugs deleted.<BR>\n";
+    }
 
     SendSQL("DELETE FROM components
              WHERE program=" . SqlQuote($product));