From e300d776bfe4cdbc1a73d28056c258bed70edb3e Mon Sep 17 00:00:00 2001 From: "justdave%syndicomm.com" Date: Mon, 3 Nov 2003 03:20:49 +0000 Subject: [PATCH] [SECURITY] Bug 209376: If you know the email address of someone who has voted on a secure bug, you can access the summary of that bug even if you do not have sufficient permissions to view the bug itself. Patch by Gervase Markham r= justdave, bbaetz a= justdave --- webtools/bugzilla/votes.cgi | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/webtools/bugzilla/votes.cgi b/webtools/bugzilla/votes.cgi index 0d9cf47b68df..ed7f6ad5197f 100755 --- a/webtools/bugzilla/votes.cgi +++ b/webtools/bugzilla/votes.cgi @@ -128,12 +128,8 @@ sub show_user { my $bug_id = $::FORM{'bug_id'} || ""; my $name = $::FORM{'user'} || Bugzilla->user->login; - my $who = DBname_to_id($name); - - # After DBNameToIdAndCheck is templatised and prints a Content-Type, - # the above should revert to a call to that function, and this - # special error handling should go away. - $who || ThrowUserError("invalid_username", {name => $name}); + my $who = DBNameToIdAndCheck($name); + my $userid = Bugzilla->user ? Bugzilla->user->id : 0; my $canedit = 1 if (Bugzilla->user && $name eq Bugzilla->user->login); @@ -193,7 +189,7 @@ sub show_user { # and they can see there are votes 'missing', but not on what bug # they are. This seems a reasonable compromise; the alternative is # to lie in the totals. - next if !CanSeeBug($id, $who); + next if !CanSeeBug($id, $userid); push (@bugs, { id => $id, summary => $summary,