From e2f691c9eb53c6a9c8b02b740b444e6d558e35e8 Mon Sep 17 00:00:00 2001
From: "lpsolit%gmail.com" <>
Date: Mon, 12 Dec 2005 11:12:25 +0000
Subject: =?UTF-8?q?Bug=20271596:=20editcomponents=20priv=20allows=20you=20?=
 =?UTF-8?q?to=20see/edit=20products=20you=20don't=20have=20access=20to=20-?=
 =?UTF-8?q?=20Patch=20by=20Fr=C3=A9d=C3=A9ric=20Buclin=20<LpSolit@gmail.co?=
 =?UTF-8?q?m>=20r=3Dwicked=20a=3Djustdave?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 editversions.cgi | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

(limited to 'editversions.cgi')

diff --git a/editversions.cgi b/editversions.cgi
index eae1001ca..be2c8a3c6 100755
--- a/editversions.cgi
+++ b/editversions.cgi
@@ -69,20 +69,22 @@ my $showbugcounts = (defined $cgi->param('showbugcounts'));
 #
 
 unless ($product_name) {
-
-    my @products = Bugzilla::Product::get_all_products();
-
+    $vars->{'products'} = $user->get_selectable_products;
     $vars->{'showbugcounts'} = $showbugcounts;
-    $vars->{'products'} = \@products;
-    $template->process("admin/versions/select-product.html.tmpl",
-                       $vars)
-      || ThrowTemplateError($template->error());
 
+    $template->process("admin/versions/select-product.html.tmpl", $vars)
+      || ThrowTemplateError($template->error());
     exit;
 }
 
+# First make sure the product name is valid.
 my $product = Bugzilla::Product::check_product($product_name);
 
+# Then make sure the user is allowed to edit properties of this product.
+$user->can_see_product($product->name)
+  || ThrowUserError('product_access_denied', {product => $product->name});
+
+
 #
 # action='' -> Show nice list of versions
 #
-- 
cgit v1.2.1