Bug #60989 [Opn->Asn]: logged in users can't access the security bugs reported by them

Edit report at https://bugs.php.net/bug.php?id=60989&edit=1 ID: 60989 Updated by: tyrael@php.net Reported by: tyrael@php.net Summary: logged in users can't access the security bugs reported by them -Status: Open +Status: Assigned Type: Bug Package: Website problem PHP Version: Irrelevant -Assigned To: +Assigned To: tyrael Block user comment: N Private report: N Previous Comments: ------------------------------------------------------------------------ [2012-05-05 21:11:59] tyrael@php.net yeah, I'm fairly sure that I restricted the access correctly. I expanded the access only for one special case: if the bug reporter was logged in(hence he/she has an svn account), when reported the bug, he/she didn't get a password, so he/she won't be able to come back later and access the bug. I added an if clause to the bugs_has_access() function to check if the bug has the reporter_name field set, and the reporter equals to the currently logged in user's handle. so the current access list is the same as you mentioned, but the reporter can be either an anonymous user authenticated with the bug pw set when opening the bug, or an authenticated user. I also fixed that there will be no public info shown to unauthorized people. ------------------------------------------------------------------------ [2012-05-05 21:01:00] pajoye@php.net I'm not sure I understand all points you listed, however: Only security members (see the list in the bugs code) should be able to see a security report. anyone else should see nothing but the bug # and the text saying that this bug is private, but not the summary, title or any other information, not even the reporter name. This is what I discussed with Felipe earlier this week as well. ------------------------------------------------------------------------ [2012-05-05 20:28:40] tyrael@php.net The following patch has been added/updated: Patch Name: bugsweb-security.diff Revision: 1336249720 URL: https://bugs.php.net/patch-display.php?bug=60989&patch=bugsweb-security.diff&revision=1336249720 ------------------------------------------------------------------------ [2012-05-05 20:26:23] tyrael@php.net the attached patch should solve the issues. I tested it on my local developer environment and it seemed to work just fine, but given the recent events, I would like somebody to review it, before I push it. ------------------------------------------------------------------------ [2012-05-05 20:25:11] tyrael@php.net The following patch has been added/updated: Patch Name: bugsweb-security.diff Revision: 1336249511 URL: https://bugs.php.net/patch-display.php?bug=60989&patch=bugsweb-security.diff&revision=1336249511 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=60989 -- Edit this bug report at https://bugs.php.net/bug.php?id=60989&edit=1