svn: /web/php-bugs/trunk/www/ patch-display.php rpc.php
| From: | Felipe Pena | Date: | Sun, 12 Dec 2010 13:52:52 +0000 |
| Subject: | svn: /web/php-bugs/trunk/www/ patch-display.php rpc.php | ||
| Groups: | php.webmaster | ||
| Request: | Send a blank email to php-webmaster+get-9691@lists.php.net to get a copy of this message | ||
felipe Sun, 12 Dec 2010 13:52:52 +0000
Revision: http://svn.php.net/viewvc?view=revision&revision=306264
Log:
- Added bug access checks
Changed paths:
U web/php-bugs/trunk/www/patch-display.php
U web/php-bugs/trunk/www/rpc.php
Modified: web/php-bugs/trunk/www/patch-display.php
===================================================================
--- web/php-bugs/trunk/www/patch-display.php 2010-12-12 13:45:58 UTC (rev 306263)
+++ web/php-bugs/trunk/www/patch-display.php 2010-12-12 13:52:52 UTC (rev 306264)
@@ -38,6 +38,13 @@
exit;
}
+if (!bugs_has_access($bug_id, $buginfo, $pw, $user_flags)) {
+ response_header('Error :: No access to bug selected');
+ display_bug_error("You have no access to bug #{$bug_id}");
+ response_footer();
+ exit;
+}
+
$pseudo_pkgs = get_pseudo_packages($site);
if (isset($patch_name) && isset($revision)) {
Modified: web/php-bugs/trunk/www/rpc.php
===================================================================
--- web/php-bugs/trunk/www/rpc.php 2010-12-12 13:45:58 UTC (rev 306263)
+++ web/php-bugs/trunk/www/rpc.php 2010-12-12 13:52:52 UTC (rev 306264)
@@ -37,6 +37,11 @@
exit;
}
+if (!bugs_has_access($bug_id, $bug, $pwd, $user_flags)) {
+ echo json_encode(array('result' => array('error' => 'No access to
bug')));
+ exit;
+}
+
if (!empty($_POST['ncomment']) && !empty($_POST['user'])) {
$user = htmlspecialchars(trim($_POST['user']));
$ncomment = htmlspecialchars(trim($_POST['ncomment']));