aboutsummaryrefslogtreecommitdiffstats
path: root/Bugzilla
diff options
context:
space:
mode:
authorSimon Green <simon@simongreen.net>2015-04-13 21:40:11 +0100
committerDavid Lawrence <dkl@mozilla.com>2015-04-13 21:40:11 +0100
commitb09ffb65cb44d366b9cef0ede9d705ba28b9d261 (patch)
treeffb838a64b7608a33223d833aba926174ff75663 /Bugzilla
parent74d7fca1e9da140388403de8b2e555291d863a96 (diff)
downloadbugs-b09ffb65cb44d366b9cef0ede9d705ba28b9d261.tar
bugs-b09ffb65cb44d366b9cef0ede9d705ba28b9d261.tar.gz
bugs-b09ffb65cb44d366b9cef0ede9d705ba28b9d261.tar.bz2
bugs-b09ffb65cb44d366b9cef0ede9d705ba28b9d261.tar.xz
bugs-b09ffb65cb44d366b9cef0ede9d705ba28b9d261.zip
Bug 1151290: It is possible to tell if someone made a private comment on a bug even if you are not an 'insider'
r=dkl,a=glob
Diffstat (limited to 'Bugzilla')
-rw-r--r--Bugzilla/Search.pm10
1 files changed, 8 insertions, 2 deletions
diff --git a/Bugzilla/Search.pm b/Bugzilla/Search.pm
index 9dea07b5d..8097d5fb8 100644
--- a/Bugzilla/Search.pm
+++ b/Bugzilla/Search.pm
@@ -2515,11 +2515,17 @@ sub _user_nonchanged {
sub _long_desc_changedby {
my ($self, $args) = @_;
my ($chart_id, $joins, $value) = @$args{qw(chart_id joins value)};
-
+
my $table = "longdescs_$chart_id";
push(@$joins, { table => 'longdescs', as => $table });
my $user_id = $self->_get_user_id($value);
$args->{term} = "$table.who = $user_id";
+
+ # If the user is not part of the insiders group, they cannot see
+ # private comments
+ if (!$self->_user->is_insider) {
+ $args->{term} .= " AND $table.isprivate = 0";
+ }
}
sub _long_desc_changedbefore_after {
@@ -2527,7 +2533,7 @@ sub _long_desc_changedbefore_after {
my ($chart_id, $operator, $value, $joins) =
@$args{qw(chart_id operator value joins)};
my $dbh = Bugzilla->dbh;
-
+
my $sql_operator = ($operator =~ /before/) ? '<=' : '>=';
my $table = "longdescs_$chart_id";
my $sql_date = $dbh->quote(SqlifyDate($value));