svn: /web/php-bugs/trunk/www/ bug.php

felipe Wed, 08 Dec 2010 20:59:30 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=306086 Log: - Allow assigned dev (non-trusted-dev) to see and post in the report - Hide the CVE-ID field to non-trusted-dev Changed paths: U web/php-bugs/trunk/www/bug.php Modified: web/php-bugs/trunk/www/bug.php =================================================================== --- web/php-bugs/trunk/www/bug.php 2010-12-08 19:43:59 UTC (rev 306085) +++ web/php-bugs/trunk/www/bug.php 2010-12-08 20:59:30 UTC (rev 306086) @@ -140,13 +140,19 @@ $show_bug_info = ($bug['private'] == 'Y' ? false : true); -// When the bug is private, just the reporter and trusted developer should see -// the report info +// When the bug is private, just the reporter, trusted developer and assigned +// dev should see the report info if ($show_bug_info === false) { if ($is_trusted_developer) { + // trusted dev $show_bug_info = true; } else if ($logged_in != 'developer' && $edit == 0 && $pw != '' && verify_bug_passwd($bug_id, $pw)) { + // The submitter $show_bug_info = true; + } else if ($logged_in == 'developer' && $bug['assign'] != '' && + strtolower($bug['assign']) == strtolower($auth_user->handle)) { + // The assigned dev + $show_bug_info = true; } } @@ -248,7 +254,7 @@ $show_bug_info = true; } - // Bug is private (just should be available to trusted developers and to original reporter) + // Bug is private (just should be available to trusted developers, original reporter and assigned dev) if (!$show_bug_info && $bug['private'] == 'Y') { response_header('Private report'); display_bug_error("The bug #{$bug_id} is not available to public"); @@ -355,8 +361,8 @@ } elseif (isset($_POST['in']) && is_array($_POST['in']) && !isset($_POST['preview']) && $edit == 1) { // Edits submitted by developer - // Bug is private (just should be available to trusted developers and to reporter) - if (!$is_trusted_developer && $bug['private'] == 'Y') { + // Bug is private (just should be available to trusted developers, submitter and assigned dev) + if (!$show_bug_info && $bug['private'] == 'Y') { response_header('Private report'); display_bug_error("The bug #{$bug_id} is not available to public"); response_footer(); @@ -378,9 +384,14 @@ $errors[] = "Please do not SPAM our bug system."; } - if (!empty($_POST['in']['cve_id'])) { - // Remove the CVE- prefix - $_POST['in']['cve_id'] = preg_replace('/^\s*CVE-/i', '', $_POST['in']['cve_id']); + if ($is_trusted_developer) { + // Just trusted dev can set CVE-ID + if (!empty($_POST['in']['cve_id'])) { + // Remove the CVE- prefix + $_POST['in']['cve_id'] = preg_replace('/^\s*CVE-/i', '', $_POST['in']['cve_id']); + } + } else { + $_POST['in']['cve_id'] = $bug['cve_id']; } if ($bug['private'] == 'N' && $bug['private'] != $is_private) { @@ -455,17 +466,14 @@ $query = 'UPDATE bugdb SET'; // Update email only if it's passed - if ($bug['email'] != $_POST['in']['email'] && !empty($_POST['in']['email'])) - { + if ($bug['email'] != $_POST['in']['email'] && !empty($_POST['in']['email'])) { $query .= " email='{$_POST['in']['email']}',"; } // Changing the package to 'Security related' should mark the bug as private automatically if ($bug['bug_type'] != $_POST['in']['bug_type']) { - if ($_POST['in']['bug_type'] == 'Security') { - if ($_POST['in']['status'] != 'Closed') { - $is_private = $_POST['in']['private'] = 'Y'; - } + if ($_POST['in']['bug_type'] == 'Security' && $_POST['in']['status'] != 'Closed') { + $is_private = $_POST['in']['private'] = 'Y'; } } @@ -819,13 +827,13 @@ <small>(<a href="quick-fix-desc.php">description</a>)</small> </td> </tr> +<?php if ($is_trusted_developer) { ?> <tr> <th class="details">CVE-ID:</th> <td colspan="3"> <input type="text" size="15" maxlength="15" name="in[cve_id]" value="<?php echo field('cve_id'); ?>" id="cve_id"/> </td> </tr> -<?php if ($is_trusted_developer) { ?> <tr> <th class="details"></th> <td colspan="3">