Fix #12361: Private bug visibility leak in my_view/view_all_bug_page

Todd Whitesel · davidhicks · commit 94e68102e82d · 2011-09-05T22:37:12.000+10:00
In the My View / View Issues screens, private bugs in public projects
(and probably private projects too) appear to ignore the
private_bug_threshold value of their project unless you select it. When
some projects have tighter security on viewing private bugs than others,
this creates a situation where a user who should not be able to see a
bug can still discover its existence in My View and View Issues. Viewing
it fails with 'access denied', but if the summary had confidential
information in it then the security leak has already happened.

I don't consider giving All Projects the tighter security to be a usable
workaround, because then you can't find bugs in the projects that use
normal security for private bugs, until you select one of them, but then
you can only see the subproject hierarchy you just went into.

Steps to reproduce:
------
On a fresh 1.2.2 install try this:

Create a public project.
In the project, edit thresholds so that you need manager to view private
bugs.
Submit a private bug to that project.

Login as a different user with global access of developer. View All
Projects.

You can see the bug in MyView / ViewIssues but then when you click on it
you get an Access Denied screen. If you select the bug's project, then
it correctly disappears.
------

Signed-off-by: David Hicks &lt;d@hx.id.au&gt;
diff --git a/core/filter_api.php b/core/filter_api.php
@@ -1201,8 +1201,8 @@ function filter_get_bug_rows( &$p_page_number, &$p_per_page, &$p_page_count, &$p
 		// this array is populated with project ids that the current user has full access to.
 		$t_private_and_public_project_ids = array();
 
-		$t_access_required_to_view_private_bugs = config_get( 'private_bug_threshold' );
 		foreach( $t_project_ids as $t_pid ) {
+			$t_access_required_to_view_private_bugs = config_get( 'private_bug_threshold', null, null, $t_pid );
 			if( access_has_project_level( $t_access_required_to_view_private_bugs, $t_pid, $t_user_id ) ) {
 				$t_private_and_public_project_ids[] = $t_pid;
 			} else {
