r368: Added in permission checks for updates

diff --git a/editreport.php b/editreport.php
index 530221c969e3be52a21d587f4e2e62d1628e2850..de2f70c638877c6ef4eb6c2af4182fe5a4806241 100644 (file)
--- a/editreport.php
+++ b/editreport.php
@@ -152,16 +152,16 @@ if ($_POST['do'] == 'update')
        $dependencies = preg_split('#([^0-9].*?)#', $bugsys->in['dependency'], -1, PREG_SPLIT_NO_EMPTY);
        $dependencies = ((count($dependencies) < 1) ? '' : implode(', ', $dependencies));
        
-       // #*# need to put in permission checks here because we do not show the fields the user has no permission to change in the edit section so they'll be blank on update
-       
        $db->query("
                UPDATE " . TABLE_PREFIX . "bug
                SET summary = '" . $bugsys->in['summary'] . "',
-                       priority = " . intval($bugsys->in['priority']) . ",
-                       status = " . intval($bugsys->in['status']) . ",
-                       severity = " . intval($bugsys->in['severity']) . ",
-                       resolution = " . intval($bugsys->in['resolution']) . ",
-                       assignedto = " . intval($bugsys->in['assignedto']) . ",
+                       severity = " . intval($bugsys->in['severity']) . "," .
+                               (can_perform('canchangestatus') ? "
+                                       priority = " . intval($bugsys->in['priority']) . ",
+                                       status = " . intval($bugsys->in['status']) . ",
+                                       resolution = " . intval($bugsys->in['resolution']) . ","
+                               : '') . "
+                       " . (can_perform('canassign') ? "assignedto = " . intval($bugsys->in['assignedto']) . "," . : '') . "
                        duplicateof = " . intval($bugsys->in['duplicateof']) . ",
                        dependency = '$dependencies',
                        productid = " . $pcv['product'] . ",
@@ -261,6 +261,8 @@ if ($_POST['do'] == 'update')
        
        $log->allowempty = false;
        
+       // -------------------------------------------------------------------
+       // more comment
        $hascomment = (!empty($bugsys->in['comment'])) ? true : false;
        
        if ($hascomment OR $autoaction['comment'])