r1104: Finally have a decent, working permissions check for bugs. However, it is...

diff --git a/includes/functions.php b/includes/functions.php
index 437fd645c186e4cc9db91874817789980df2da75..09c8bc298b31e220c32b847a724b314f21db78f9 100755 (executable)
--- a/includes/functions.php
+++ b/includes/functions.php
@@ -508,6 +508,52 @@ function fetch_guest_user()
        );
 }
 
+// ###################################################################
+/**
+* Does an exhaustive permissions check on the bug. It checks for hidden
+* bug status and ability to view hidden bugs. This normally was done
+* at the top of each page, but it got so big, it was moved to a function.
+*
+* @access      public
+*
+* @param       array   Bug array
+* @param       array   Alternate user array
+*
+* @return      bool    Does the user have permission
+*/
+function check_bug_permissions($bug, $userinfo = null)
+{
+       global $bugsys;
+       if ($userinfo == null)
+       {
+               $userinfo = $bugsys->userinfo;
+       }
+       
+       if
+       (
+               !can_perform('canviewbugs', $bug['product'], $userinfo)
+                       OR
+               !(
+                       (
+                               $bug['hidden']
+                                       AND
+                               (
+                                       ($userinfo['userid'] == $bug['userid'] AND can_perform('canviewownhidden', $bug['productid'], $userinfo))
+                                               OR
+                                       can_perform('canviewhidden', $bug['productid'], $userinfo)
+                               )
+                       )
+                               OR
+                       !$bug['hidden']
+               )
+       )
+       {
+               return false;
+       }
+       
+       return true;
+}
+
 /*=====================================================================*\
 || ###################################################################
 || # $HeadURL$

diff --git a/showreport.php b/showreport.php
index 0e0afeb353b092874396eb234db68b1b3d5183d6..bf1c69974a43c79e8e3951bf8e62dfe9f8ee02fa 100644 (file)
--- a/showreport.php
+++ b/showreport.php
@@ -84,7 +84,7 @@ if (!is_array($bug))
        $message->error($lang->getlex('error_invalid_id'));
 }
 
-if (!(($bug['hidden'] AND can_perform('canviewhidden', $bug['product'])) OR ($bug['hidden'] AND $bugsys->userinfo['userid'] == $bug['userid'] AND can_perform('canviewownhidden', $bug['productid']))) AND can_perform('canviewbugs', $bug['product']))
+if (!check_bug_permissions($bug))
 {
        $message->error_permission();
 }