Skip to content

bugzilla
bugzilla
Commit 0e9fdfdc authored by lpsolit%gmail.com's avatar lpsolit%gmail.com
Browse files
Options

Bug 304696: Replace UserInGroup() by $user->in_group() when checking user privs…

Bug 304696: Replace UserInGroup() by $user->in_group() when checking user privs in edit*.cgi files - Patch by Frédéric Buclin <LpSolit@gmail.com> r=mkanat a=justdave
parent b0fbfe87
Show whitespace changes
Inline Side-by-side
Showing with 20 additions and 30 deletions
doeditparams.cgi
View file @ 0e9fdfdc
...@@ -28,18 +28,17 @@ use lib qw(.); ...@@ -28,18 +28,17 @@ use lib qw(.);
use Bugzilla; use Bugzilla;
use Bugzilla::Constants; use Bugzilla::Constants;
use Bugzilla::Config qw(:DEFAULT :admin $datadir); use Bugzilla::Config qw(:DEFAULT :admin $datadir);
use Bugzilla::User;
require "globals.pl"; require "globals.pl";
Bugzilla->login(LOGIN_REQUIRED); my $user = Bugzilla->login(LOGIN_REQUIRED);
my $cgi = Bugzilla->cgi; my $cgi = Bugzilla->cgi;
my $template = Bugzilla->template; my $template = Bugzilla->template;
print $cgi->header(); print $cgi->header();
UserInGroup("tweakparams") $user->in_group('tweakparams')
|| ThrowUserError("auth_failure", {group => "tweakparams", || ThrowUserError("auth_failure", {group => "tweakparams",
action => "modify", action => "modify",
object => "parameters"}); object => "parameters"});
......
editcomponents.cgi
View file @ 0e9fdfdc
...@@ -53,7 +53,7 @@ my $whoid = $user->id; ...@@ -53,7 +53,7 @@ my $whoid = $user->id;
print $cgi->header(); print $cgi->header();
UserInGroup("editcomponents") $user->in_group('editcomponents')
|| ThrowUserError("auth_failure", {group => "editcomponents", || ThrowUserError("auth_failure", {group => "editcomponents",
action => "edit", action => "edit",
object => "components"}); object => "components"});
......
editflagtypes.cgi
View file @ 0e9fdfdc
...@@ -37,14 +37,13 @@ use Bugzilla::Constants; ...@@ -37,14 +37,13 @@ use Bugzilla::Constants;
use Bugzilla::Flag; use Bugzilla::Flag;
use Bugzilla::FlagType; use Bugzilla::FlagType;
use Bugzilla::Group; use Bugzilla::Group;
use Bugzilla::User;
use Bugzilla::Util; use Bugzilla::Util;
use vars qw( $template $vars ); use vars qw( $template $vars );
# Make sure the user is logged in and is an administrator. # Make sure the user is logged in and is an administrator.
Bugzilla->login(LOGIN_REQUIRED); my $user = Bugzilla->login(LOGIN_REQUIRED);
UserInGroup("editcomponents") $user->in_group('editcomponents')
|| ThrowUserError("auth_failure", {group => "editcomponents", || ThrowUserError("auth_failure", {group => "editcomponents",
action => "edit", action => "edit",
object => "flagtypes"}); object => "flagtypes"});
......
editgroups.cgi
View file @ 0e9fdfdc
...@@ -31,7 +31,6 @@ use lib "."; ...@@ -31,7 +31,6 @@ use lib ".";
use Bugzilla; use Bugzilla;
use Bugzilla::Constants; use Bugzilla::Constants;
use Bugzilla::User;
use Bugzilla::Group; use Bugzilla::Group;
require "globals.pl"; require "globals.pl";
...@@ -40,11 +39,11 @@ my $dbh = Bugzilla->dbh; ...@@ -40,11 +39,11 @@ my $dbh = Bugzilla->dbh;
use vars qw($template $vars); use vars qw($template $vars);
Bugzilla->login(LOGIN_REQUIRED); my $user = Bugzilla->login(LOGIN_REQUIRED);
print $cgi->header(); print $cgi->header();
UserInGroup("creategroups") $user->in_group('creategroups')
|| ThrowUserError("auth_failure", {group => "creategroups", || ThrowUserError("auth_failure", {group => "creategroups",
action => "edit", action => "edit",
object => "groups"}); object => "groups"});
......
editkeywords.cgi
View file @ 0e9fdfdc
...@@ -28,7 +28,6 @@ require "globals.pl"; ...@@ -28,7 +28,6 @@ require "globals.pl";
use Bugzilla; use Bugzilla;
use Bugzilla::Constants; use Bugzilla::Constants;
use Bugzilla::Config qw(:DEFAULT $datadir); use Bugzilla::Config qw(:DEFAULT $datadir);
use Bugzilla::User;
my $cgi = Bugzilla->cgi; my $cgi = Bugzilla->cgi;
my $dbh = Bugzilla->dbh; my $dbh = Bugzilla->dbh;
...@@ -60,11 +59,11 @@ sub Validate { ...@@ -60,11 +59,11 @@ sub Validate {
# Preliminary checks: # Preliminary checks:
# #
Bugzilla->login(LOGIN_REQUIRED); my $user = Bugzilla->login(LOGIN_REQUIRED);
print $cgi->header(); print $cgi->header();
UserInGroup("editkeywords") $user->in_group('editkeywords')
|| ThrowUserError("auth_failure", {group => "editkeywords", || ThrowUserError("auth_failure", {group => "editkeywords",
action => "edit", action => "edit",
object => "keywords"}); object => "keywords"});
......
editmilestones.cgi
View file @ 0e9fdfdc
...@@ -23,7 +23,6 @@ require "globals.pl"; ...@@ -23,7 +23,6 @@ require "globals.pl";
use Bugzilla::Constants; use Bugzilla::Constants;
use Bugzilla::Config qw(:DEFAULT $datadir); use Bugzilla::Config qw(:DEFAULT $datadir);
use Bugzilla::User;
use Bugzilla::Product; use Bugzilla::Product;
use Bugzilla::Milestone; use Bugzilla::Milestone;
use Bugzilla::Bug; use Bugzilla::Bug;
...@@ -42,7 +41,7 @@ my $whoid = $user->id; ...@@ -42,7 +41,7 @@ my $whoid = $user->id;
print $cgi->header(); print $cgi->header();
UserInGroup("editcomponents") $user->in_group('editcomponents')
|| ThrowUserError("auth_failure", {group => "editcomponents", || ThrowUserError("auth_failure", {group => "editcomponents",
action => "edit", action => "edit",
object => "milestones"}); object => "milestones"});
......
editparams.cgi
View file @ 0e9fdfdc
...@@ -27,17 +27,16 @@ use lib "."; ...@@ -27,17 +27,16 @@ use lib ".";
use Bugzilla::Constants; use Bugzilla::Constants;
use Bugzilla::Config qw(:DEFAULT :admin); use Bugzilla::Config qw(:DEFAULT :admin);
use Bugzilla::User;
require "globals.pl"; require "globals.pl";
Bugzilla->login(LOGIN_REQUIRED); my $user = Bugzilla->login(LOGIN_REQUIRED);
my $template = Bugzilla->template; my $template = Bugzilla->template;
print Bugzilla->cgi->header(); print Bugzilla->cgi->header();
UserInGroup("tweakparams") $user->in_group('tweakparams')
|| ThrowUserError("auth_failure", {group => "tweakparams", || ThrowUserError("auth_failure", {group => "tweakparams",
action => "modify", action => "modify",
object => "parameters"}); object => "parameters"});
......
editproducts.cgi
View file @ 0e9fdfdc
...@@ -37,7 +37,6 @@ use Bugzilla::Constants; ...@@ -37,7 +37,6 @@ use Bugzilla::Constants;
require "globals.pl"; require "globals.pl";
use Bugzilla::Bug; use Bugzilla::Bug;
use Bugzilla::Series; use Bugzilla::Series;
use Bugzilla::User;
use Bugzilla::Config qw(:DEFAULT $datadir); use Bugzilla::Config qw(:DEFAULT $datadir);
# Shut up misguided -w warnings about "used only once". "use vars" just # Shut up misguided -w warnings about "used only once". "use vars" just
...@@ -242,7 +241,7 @@ my $whoid = $user->id; ...@@ -242,7 +241,7 @@ my $whoid = $user->id;
my $cgi = Bugzilla->cgi; my $cgi = Bugzilla->cgi;
print $cgi->header(); print $cgi->header();
UserInGroup("editcomponents") $user->in_group('editcomponents')
|| ThrowUserError("auth_failure", {group => "editcomponents", || ThrowUserError("auth_failure", {group => "editcomponents",
action => "edit", action => "edit",
object => "products"}); object => "products"});
......
editsettings.cgi
View file @ 0e9fdfdc
...@@ -21,7 +21,6 @@ use lib qw(.); ...@@ -21,7 +21,6 @@ use lib qw(.);
use Bugzilla; use Bugzilla;
use Bugzilla::Constants; use Bugzilla::Constants;
use Bugzilla::User;
use Bugzilla::User::Setting; use Bugzilla::User::Setting;
require "globals.pl"; require "globals.pl";
...@@ -69,12 +68,12 @@ sub SaveSettings{ ...@@ -69,12 +68,12 @@ sub SaveSettings{
### Live code ### ### Live code ###
################### ###################
Bugzilla->login(LOGIN_REQUIRED); my $user = Bugzilla->login(LOGIN_REQUIRED);
my $cgi = Bugzilla->cgi; my $cgi = Bugzilla->cgi;
print $cgi->header; print $cgi->header;
UserInGroup("tweakparams") $user->in_group('tweakparams')
|| ThrowUserError("auth_failure", {group => "tweakparams", || ThrowUserError("auth_failure", {group => "tweakparams",
action => "modify", action => "modify",
object => "settings"}); object => "settings"});
......
editusers.cgi
View file @ 0e9fdfdc
...@@ -43,7 +43,7 @@ my $editusers = $user->in_group('editusers'); ...@@ -43,7 +43,7 @@ my $editusers = $user->in_group('editusers');
# Reject access if there is no sense in continuing. # Reject access if there is no sense in continuing.
$editusers $editusers
|| Bugzilla->user->can_bless() || $user->can_bless()
|| ThrowUserError("auth_failure", {group => "editusers", || ThrowUserError("auth_failure", {group => "editusers",
reason => "cant_bless", reason => "cant_bless",
action => "edit", action => "edit",
......
editversions.cgi
View file @ 0e9fdfdc
...@@ -35,7 +35,6 @@ require "globals.pl"; ...@@ -35,7 +35,6 @@ require "globals.pl";
use Bugzilla::Constants; use Bugzilla::Constants;
use Bugzilla::Config qw(:DEFAULT $datadir); use Bugzilla::Config qw(:DEFAULT $datadir);
use Bugzilla::User;
use Bugzilla::Product; use Bugzilla::Product;
use Bugzilla::Version; use Bugzilla::Version;
...@@ -48,11 +47,11 @@ my $dbh = Bugzilla->dbh; ...@@ -48,11 +47,11 @@ my $dbh = Bugzilla->dbh;
# Preliminary checks: # Preliminary checks:
# #
Bugzilla->login(LOGIN_REQUIRED); my $user = Bugzilla->login(LOGIN_REQUIRED);
print $cgi->header(); print $cgi->header();
UserInGroup("editcomponents") $user->in_group('editcomponents')
|| ThrowUserError("auth_failure", {group => "editcomponents", || ThrowUserError("auth_failure", {group => "editcomponents",
action => "edit", action => "edit",
object => "versions"}); object => "versions"});
......
editwhines.cgi
View file @ 0e9fdfdc
...@@ -36,7 +36,7 @@ use Bugzilla::Constants; ...@@ -36,7 +36,7 @@ use Bugzilla::Constants;
use Bugzilla::User; use Bugzilla::User;
use Bugzilla::Group; use Bugzilla::Group;
# require the user to have logged in # require the user to have logged in
Bugzilla->login(LOGIN_REQUIRED); my $user = Bugzilla->login(LOGIN_REQUIRED);
############################################################################### ###############################################################################
# Main Body Execution # Main Body Execution
...@@ -46,7 +46,6 @@ my $cgi = Bugzilla->cgi; ...@@ -46,7 +46,6 @@ my $cgi = Bugzilla->cgi;
my $template = Bugzilla->template; my $template = Bugzilla->template;
my $dbh = Bugzilla->dbh; my $dbh = Bugzilla->dbh;
my $user = Bugzilla->user;
my $userid = $user->id; my $userid = $user->id;
my $sth; # database statement handle my $sth; # database statement handle
...@@ -73,7 +72,7 @@ my $sth; # database statement handle ...@@ -73,7 +72,7 @@ my $sth; # database statement handle
my $events = get_events($userid); my $events = get_events($userid);
# First see if this user may use whines # First see if this user may use whines
UserInGroup("bz_canusewhines") $user->in_group('bz_canusewhines')
|| ThrowUserError("auth_failure", {group => "bz_canusewhines", || ThrowUserError("auth_failure", {group => "bz_canusewhines",
action => "schedule", action => "schedule",
object => "reports"}); object => "reports"});
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment