From f47c0339e2c258c878e6284970d917dcd3960cba Mon Sep 17 00:00:00 2001
From: "terry%mozilla.org" <>
Date: Thu, 27 May 1999 22:17:25 +0000
Subject: Patched minor security hole; don't show summary of bugs that the user
 doesn't have permission to see.

---
 showdependencytree.cgi | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

(limited to 'showdependencytree.cgi')

diff --git a/showdependencytree.cgi b/showdependencytree.cgi
index 92964648f..f457d67a3 100755
--- a/showdependencytree.cgi
+++ b/showdependencytree.cgi
@@ -37,6 +37,10 @@ PutHeader("Dependency tree", "Dependency tree", "Bug $linkedid");
 
 ConnectToDatabase();
 
+quietly_check_login();
+
+$::usergroupset = $::usergroupset; # More warning suppression silliness.
+
 my %seen;
 
 sub DumpKids {
@@ -53,8 +57,10 @@ sub DumpKids {
     if (@list) {
         print "<ul>\n";
         foreach my $kid (@list) {
-            SendSQL("select bug_status, short_desc from bugs where bug_id = $kid");
+            SendSQL("select bug_status, short_desc from bugs where bug_id = $kid and bugs.groupset & $::usergroupset = bugs.groupset");
             my ($stat, $short_desc) = (FetchSQLData());
+            $stat = "NEW" if !defined $stat;
+            $short_desc = "" if !defined $short_desc;
             my $opened = ($stat eq "NEW" || $stat eq "ASSIGNED" ||
                           $stat eq "REOPENED");
             print "<li>";
-- 
cgit v1.2.3-24-g4f1b