From 9ec7d139f9ab26fc2cc6986ec72d254d0fdef242 Mon Sep 17 00:00:00 2001 From: Frédéric Buclin Date: Thu, 9 Aug 2012 13:45:59 +0200 Subject: Bug 756550: Do not link a bug alias with its bug ID for bugs you cannot see r=glob a=LpSolit --- Bugzilla/Search/Quicksearch.pm | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'Bugzilla/Search') diff --git a/Bugzilla/Search/Quicksearch.pm b/Bugzilla/Search/Quicksearch.pm index 10f3f768b..17c5635ff 100644 --- a/Bugzilla/Search/Quicksearch.pm +++ b/Bugzilla/Search/Quicksearch.pm @@ -285,9 +285,10 @@ sub _handle_alias { if ($searchstring =~ /^([^,\s]+)$/) { my $alias = $1; # We use this direct SQL because we want quicksearch to be VERY fast. - my $is_alias = Bugzilla->dbh->selectrow_array( - q{SELECT 1 FROM bugs WHERE alias = ?}, undef, $alias); - if ($is_alias) { + my $bug_id = Bugzilla->dbh->selectrow_array( + q{SELECT bug_id FROM bugs WHERE alias = ?}, undef, $alias); + # If the user cannot see the bug, do not resolve its alias. + if ($bug_id && Bugzilla->user->can_see_bug($bug_id)) { $alias = url_quote($alias); print Bugzilla->cgi->redirect( -uri => correct_urlbase() . "show_bug.cgi?id=$alias"); -- cgit v1.2.3-24-g4f1b