summaryrefslogtreecommitdiffstats
path: root/template
diff options
context:
space:
mode:
authorlpsolit%gmail.com <>2009-08-01 14:35:46 +0200
committerlpsolit%gmail.com <>2009-08-01 14:35:46 +0200
commit2039a990c46a153a30a15b6e76e19062c5565e02 (patch)
tree53cc73654ed593baae26e597b29e949e20444b1d /template
parent8bd1ee512f2e16192c38da0887caa7dbfc7f4dc1 (diff)
downloadbugzilla-2039a990c46a153a30a15b6e76e19062c5565e02.tar.gz
bugzilla-2039a990c46a153a30a15b6e76e19062c5565e02.tar.xz
Bug 507389: [SECURITY] Users can see all products when editing bugs - Patch by Frédéric Buclin <LpSolit@gmail.com> r=mkanat a=LpSolit
Diffstat (limited to 'template')
-rw-r--r--template/en/default/bug/edit.html.tmpl8
-rw-r--r--template/en/default/bug/field.html.tmpl6
2 files changed, 13 insertions, 1 deletions
diff --git a/template/en/default/bug/edit.html.tmpl b/template/en/default/bug/edit.html.tmpl
index 9434271d8..2ce19833e 100644
--- a/template/en/default/bug/edit.html.tmpl
+++ b/template/en/default/bug/edit.html.tmpl
@@ -375,8 +375,16 @@
[%#############%]
<tr>
+ [% IF bug.check_can_change_field('product', 0, 1) %]
+ [% prod_list = user.get_enterable_products %]
+ [% IF NOT user.can_enter_product(bug.product) %]
+ [% prod_list.unshift(bug.product_obj) %]
+ [% END %]
+ [% END %]
+
[% INCLUDE bug/field.html.tmpl
bug = bug, field = select_fields.product,
+ override_legal_values = prod_list
desc_url = 'describecomponents.cgi', value = bug.product
editable = bug.check_can_change_field('product', 0, 1) %]
</tr>
diff --git a/template/en/default/bug/field.html.tmpl b/template/en/default/bug/field.html.tmpl
index 039910f1d..e8ed85010 100644
--- a/template/en/default/bug/field.html.tmpl
+++ b/template/en/default/bug/field.html.tmpl
@@ -23,6 +23,7 @@
[%# INTERFACE:
# field: a Bugzilla::Field object
# value: The value of the field for this bug.
+ # override_legal_values (optional): The list of legal values, for select fields.
# editable: Whether the field should be displayed as an editable
# <input> or as just the plain text of its value.
# allow_dont_change: display the --do_not_change-- option for select fields.
@@ -130,7 +131,10 @@
[% dontchange FILTER html %]
</option>
[% END %]
- [% FOREACH legal_value = field.legal_values %]
+ [% IF NOT override_legal_values %]
+ [% override_legal_values = field.legal_values %]
+ [% END %]
+ [% FOREACH legal_value = override_legal_values %]
[% SET control_value = legal_value.visibility_value %]
[% SET control_field = field.value_field %]
<option value="[% legal_value.name FILTER html %]"