From cda6e20b9ab268a042b51f9ef868849c1da62d98 Mon Sep 17 00:00:00 2001 From: "lpsolit%gmail.com" <> Date: Thu, 23 Aug 2007 20:41:22 +0000 Subject: Bug 382056: [SECURITY] Bugzilla::Webservice::Bug->get_bugs() doesn't check if the user is in the timetracking group when returning data - Patch by Frédéric Buclin r=mkanat a=LpSolit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Bugzilla/WebService/Bug.pm | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'Bugzilla/WebService') diff --git a/Bugzilla/WebService/Bug.pm b/Bugzilla/WebService/Bug.pm index a2710c482..14ed2e7fd 100755 --- a/Bugzilla/WebService/Bug.pm +++ b/Bugzilla/WebService/Bug.pm @@ -70,6 +70,13 @@ sub get_bugs { ValidateBugID($bug_id); my $bug = new Bugzilla::Bug($bug_id); + # Timetracking fields are deleted if the user doesn't belong to + # the corresponding group. + unless (Bugzilla->user->in_group(Bugzilla->params->{'timetrackinggroup'})) { + delete $bug->{'estimated_time'}; + delete $bug->{'remaining_time'}; + delete $bug->{'deadline'}; + } # This is done in this fashion in order to produce a stable API. # The internals of Bugzilla::Bug are not stable enough to just # return them directly. -- cgit v1.2.3-24-g4f1b