Correct access checks in mc_issue_get_id_from_summary

Fixes #13736: mc_issue_get_id_from_summary incorrectly checks for permissions
mantisbt · Mar 3, 2012 · 4dd69a5 · 4dd69a5
1 parent dea7e31
commit 4dd69a5
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/api/soap/mc_issue_api.php b/api/soap/mc_issue_api.php
@@ -491,7 +491,8 @@ function mc_issue_get_id_from_summary( $p_username, $p_password, $p_summary ) {
 			$t_issue_id = (int) $row['id'];
 			$t_project_id = bug_get_field( $t_issue_id, 'project_id' );
 
-			if( mci_has_readonly_access( $t_user_id, $t_project_id ) ) {
+			if( mci_has_readonly_access( $t_user_id, $t_project_id ) &&
+				access_has_bug_level( VIEWER, $t_issue_id, $t_user_id ) ) {
 				return $t_issue_id;
 			}
 		}