r1097: Setting up permssions for canviewownhidden

diff --git a/editcomment.php b/editcomment.php
index 3c035f75f3163664b1fa457ef2452c4e84df0c58..c2b676cad1641d2b2154e91d3906e88583aa6175 100644 (file)
--- a/editcomment.php
+++ b/editcomment.php
@@ -42,7 +42,7 @@ $comment =& $commentapi->objdata;
 
 $bug = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "bug WHERE bugid = $comment[bugid]");
 
-if ($bug['hidden'] AND !can_perform('canviewhidden', $bug['product']))
+if (!(($bug['hidden'] AND can_perform('canviewhidden', $bug['product'])) OR ($bug['hidden'] AND $bugsys->userinfo['userid'] == $bug['userid'] AND can_perform('canviewownhidden'))) AND can_perform('canviewbugs', $bug['product']))
 {
        $message->error_permissison();
 }

diff --git a/editreport.php b/editreport.php
index 723ac9709bc91a8c9458d9c82201925039011811..e2ce90ce335a9686591d0561c64c7388605de361 100644 (file)
--- a/editreport.php
+++ b/editreport.php
@@ -47,7 +47,7 @@ if (!$bug)
        $message->error($lang->getlex('error_invalid_id'));
 }
 
-if ($bug['hidden'] AND !can_perform('canviewhidden', $bug['product']))
+if (!(($bug['hidden'] AND can_perform('canviewhidden', $bug['product'])) OR ($bug['hidden'] AND $bugsys->userinfo['userid'] == $bug['userid'] AND can_perform('canviewownhidden'))) AND can_perform('canviewbugs', $bug['product']))
 {
        $message->error_permission();
 }

diff --git a/showhistory.php b/showhistory.php
index 83e15554db9c74a178ddd5ebe97b6862ea09bbf4..cb4e901c1f123e5ba799f97e56a6860447083869 100644 (file)
--- a/showhistory.php
+++ b/showhistory.php
@@ -37,7 +37,7 @@ if (!$bug)
        $message->error($lang->getlex('error_invalid_id'));
 }
 
-if (($bug['hidden'] AND !can_perform('canviewhidden', $bug['product'])) OR !can_perform('canviewbugs', $bug['product']))
+if (!(($bug['hidden'] AND can_perform('canviewhidden', $bug['product'])) OR ($bug['hidden'] AND $bugsys->userinfo['userid'] == $bug['userid'] AND can_perform('canviewownhidden'))) AND can_perform('canviewbugs', $bug['product']))
 {
        $message->error_permission();
 }

diff --git a/showreport.php b/showreport.php
index e27a5e65d263bdba327496e3bb3abf17ee27356a..1837ad675f5fa7a9b3c0228f9b75f698c8ecf596 100644 (file)
--- a/showreport.php
+++ b/showreport.php
@@ -84,7 +84,7 @@ if (!is_array($bug))
        $message->error($lang->getlex('error_invalid_id'));
 }
 
-if ($bug['hidden'] AND !can_perform('canviewhidden', $bug['product']))
+if (!(($bug['hidden'] AND can_perform('canviewhidden', $bug['product'])) OR ($bug['hidden'] AND $bugsys->userinfo['userid'] == $bug['userid'] AND can_perform('canviewownhidden'))) AND can_perform('canviewbugs', $bug['product']))
 {
        $message->error_permission();
 }