Additional patch to fix #14016

atrol · atrol · commit 75568c536d66 · 2012-06-03T13:53:41.000+02:00
First patch to fix the issue introduced access to undefined variable.
diff --git a/api/soap/mc_issue_attachment_api.php b/api/soap/mc_issue_attachment_api.php
@@ -72,7 +72,7 @@ function mc_issue_attachment_delete( $p_username, $p_password, $p_issue_attachme
 	$t_bug_id = file_get_field( $p_issue_attachment_id, 'bug_id' );
 
 	# Perform access control checks
-	$t_attachment_owner = file_get_field( $f_file_id, 'user_id' );
+	$t_attachment_owner = file_get_field( $p_issue_attachment_id, 'user_id' );
 	$t_current_user_is_attachment_owner = $t_attachment_owner == $t_user_id;
 	# Factor in allow_delete_own_attachments=ON|OFF
 	if ( !$t_current_user_is_attachment_owner || ( $t_current_user_is_attachment_owner && !config_get( 'allow_delete_own_attachments' ) ) ) {
