Patched minor security hole; don't show summary of bugs that the user

doesn't have permission to see.

1 files changed, 7 insertions, 1 deletions

diff --git a/showdependencytree.cgi b/showdependencytree.cgi
index 92964648f..f457d67a3 100755
--- a/showdependencytree.cgi
+++ b/showdependencytree.cgi
@@ -37,6 +37,10 @@ PutHeader("Dependency tree", "Dependency tree", "Bug $linkedid");
 
 ConnectToDatabase();
 
+quietly_check_login();
+
+$::usergroupset = $::usergroupset; # More warning suppression silliness.
+
 my %seen;
 
 sub DumpKids {
@@ -53,8 +57,10 @@ sub DumpKids {
     if (@list) {
         print "<ul>\n";
         foreach my $kid (@list) {
-            SendSQL("select bug_status, short_desc from bugs where bug_id = $kid");
+            SendSQL("select bug_status, short_desc from bugs where bug_id = $kid and bugs.groupset & $::usergroupset = bugs.groupset");
             my ($stat, $short_desc) = (FetchSQLData());
+            $stat = "NEW" if !defined $stat;
+            $short_desc = "" if !defined $short_desc;
             my $opened = ($stat eq "NEW" || $stat eq "ASSIGNED" ||
                           $stat eq "REOPENED");
             print "<li>";