r1117: *FINALLY* fixing the NotificationCenter->finalize() permissions checking bug.

diff --git a/includes/class_notification.php b/includes/class_notification.php
index 9bda1056772db034d9e6a771e10ecd0d486ef2da..6d3b3a72354a0f80c2a11f60c0319b64117bd53d 100644 (file)
--- a/includes/class_notification.php
+++ b/includes/class_notification.php
@@ -639,6 +639,8 @@ Initial report:
        */
        function finalize()
        {
+               // get the current bug for permissions checks
+               $bug = $this->registry->db->query_first("SELECT * FROM " . TABLE_PREFIX . "bug WHERE bugid = " . $this->bug['bugid']);
                $this->registry->mail->set('subject',   sprintf(_('%1$s Bug Notification - %2$s'), $this->registry->options['trackertitle'], $this->bug['summary']));
                foreach ($this->notices AS $userid => $noticelist)
                {
@@ -648,7 +650,7 @@ Initial report:
                        }
                        
                        // we wouldn't want people who favorite bugs getting hidden notices
-                       if (!check_bug_permissions($this->bug, $this->users["$userid"]))
+                       if (!check_bug_permissions($bug, $this->users["$userid"]))
                        {
                                $this->registry->debug("skipping user $userid ({$this->users[$userid]['email']}) because of permissions");
                                continue;

diff --git a/includes/functions.php b/includes/functions.php
index a3fb55897667daec3b18df5858ee36c52b730dae..c1289bccb6575f56c2b0c31bf530f513c0eb4fd9 100755 (executable)
--- a/includes/functions.php
+++ b/includes/functions.php
@@ -538,6 +538,17 @@ function check_bug_permissions($bug, $userinfo = null)
        
        $bugsys->debug("checking permissions for $userinfo[userid] on bug $bug[bugid]");
        
+       $bugsys->debug('*** START VERBOSE CHECK ***');
+       
+       $bugsys->debug('* !can_perform(canviewbugs, $bug[product], $userinfo) = ' . (int)(!can_perform('canviewbugs', $bug['product'], $userinfo)));
+       $bugsys->debug('* $bug[hidden] = ' . (int)$bug['hidden']);
+       $bugsys->debug('* $userinfo[userid] (' . $userinfo['userid'] . ') == $bug[userid] (' . $bug['userid'] . ') = ' . (int)($userinfo['userid'] == $bug['userid']));
+       $bugsys->debug('* can_perform(canviewownhidden, $bug[product], $userinfo) = ' . (int)(!!can_perform('canviewownhidden', $bug['product'], $userinfo)));
+       $bugsys->debug('* can_perform(canviewhidden, $bug[product], $userinfo) = ' . (int)(!!can_perform('canviewhidden', $bug['product'], $userinfo)));
+       $bugsys->debug('* !$bug[hidden] = ' . (int)(!$bug['hidden']));
+       
+       $bugsys->debug('*** END PERMISSIONS CHECK ***');
+       
        if
        (
                !can_perform('canviewbugs', $bug['product'], $userinfo)
@@ -557,9 +568,12 @@ function check_bug_permissions($bug, $userinfo = null)
                )
        )
        {
+               $bugsys->debug('*** DONE WITH REAL CALLS ***');
                return false;
        }
        
+       $bugsys->debug('*** DONE WITH REAL CALLS ***');
+       
        return true;
 }