summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rwxr-xr-xprocess_bug.cgi9
1 files changed, 8 insertions, 1 deletions
diff --git a/process_bug.cgi b/process_bug.cgi
index 98b799670..f0cd560cd 100755
--- a/process_bug.cgi
+++ b/process_bug.cgi
@@ -227,6 +227,7 @@ if ($cgi->cookie("BUGLIST") && defined $cgi->param('id')) {
defined($cgi->param('product'))
|| ThrowCodeError('undefined_field', { field => 'product' });
+my $product_change = 0;
if ((defined $cgi->param('id') && $cgi->param('product') ne $bug->product)
|| (!$cgi->param('id')
&& $cgi->param('product') ne $cgi->param('dontchange')))
@@ -371,6 +372,7 @@ if ((defined $cgi->param('id') && $cgi->param('product') ne $bug->product)
|| ThrowTemplateError($template->error());
exit;
}
+ $product_change = 1;
}
# At this point, the component must be defined, even if set to "dontchange".
@@ -1387,7 +1389,12 @@ foreach my $id (@idlist) {
}
# When editing several bugs at once, only consider groups which
# have been displayed.
- elsif (defined $cgi->param('id') || defined $cgi->param("bit-$gid")) {
+ # Only members of a group can add/remove the bug to/from it,
+ # unless the bug is being moved to another product in which case
+ # non-members can also edit group restrictions.
+ elsif (($user->in_group_id($gid) || $product_change)
+ && (defined $cgi->param('id') || defined $cgi->param("bit-$gid")))
+ {
if (!$cgi->param("bit-$gid")) {
delete $updated_groups{$gid};
}