From 38fa3fab5ae996c6116b55fe87e60ea6b53b2923 Mon Sep 17 00:00:00 2001 From: Dave Lawrence Date: Wed, 14 Nov 2012 11:07:55 -0500 Subject: Bug 804978 - The BzAPI extension let everybody see all confidential product names when classifications are enabled --- extensions/BzAPI/template/en/default/config.json.tmpl | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) (limited to 'extensions/BzAPI') diff --git a/extensions/BzAPI/template/en/default/config.json.tmpl b/extensions/BzAPI/template/en/default/config.json.tmpl index a3556ed3d..9c6852346 100644 --- a/extensions/BzAPI/template/en/default/config.json.tmpl +++ b/extensions/BzAPI/template/en/default/config.json.tmpl @@ -121,16 +121,15 @@ OLDATTACH2NEW = { "max_attachment_size": [% (Param('maxattachmentsize') * 1000) FILTER json %], [% IF Param('useclassification') %] - [% classifications = user.get_selectable_classifications() %] [% cl_name_for = {} %] - "classification": { - [% FOREACH cl IN classifications %] + "classification": { + [% FOREACH cl IN user.get_selectable_classifications() %] [% cl_name_for.${cl.id} = cl.name %] "[% cl.name FILTER json %]": { "id": [% cl.id FILTER json %], "description": "[% cl.description FILTER json %]", "products": [ - [% FOREACH product IN cl.products %] + [% FOREACH product IN user.get_selectable_products(cl.id) %] "[% product.name FILTER json %]"[% ',' UNLESS loop.last() %] [% END %] ] -- cgit v1.2.3-24-g4f1b