From 6bd37cce67502e54410dde53f615b5d9b860a4be Mon Sep 17 00:00:00 2001
From: "bugreport%peshkin.net" <>
Date: Wed, 11 Dec 2002 08:41:19 +0000
Subject: Bug 184256 Canedit group_control_map entry does not prevent making
 attachments r=bbaetz a=justdave

---
 Bugzilla/Attachment.pm | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

(limited to 'Bugzilla')

diff --git a/Bugzilla/Attachment.pm b/Bugzilla/Attachment.pm
index 27d7fa2ca..322a3b2ba 100644
--- a/Bugzilla/Attachment.pm
+++ b/Bugzilla/Attachment.pm
@@ -65,6 +65,11 @@ sub query
   my ($bugid) = @_;
 
   my $in_editbugs = &::UserInGroup("editbugs");
+  &::SendSQL("SELECT product_id
+           FROM bugs 
+           WHERE bug_id = $bugid");
+  my $productid = &::FetchOneColumn();
+  my $caneditproduct = &::CanEditProductId($productid);
 
   # Retrieve a list of attachments for this bug and write them into an array
   # of hashes in which each hash represents a single attachment.
@@ -88,8 +93,8 @@ sub query
     # ie the are the submitter, or they have canedit.
     # Also show the link if the user is not logged in - in that cae,
     # They'll be prompted later
-    $a{'canedit'} = ($::userid == 0 || $submitter_id == $::userid ||
-                     $in_editbugs);
+    $a{'canedit'} = ($::userid == 0 || (($submitter_id == $::userid ||
+                     $in_editbugs) && $caneditproduct));
     push @attachments, \%a;
   }
   
-- 
cgit v1.2.3-24-g4f1b