From e7fe953588fbcc3cca09ece2a606e5ba48a359ce Mon Sep 17 00:00:00 2001 From: David Hicks Date: Sat, 20 Feb 2010 14:17:33 +1100 Subject: [PATCH] Fix #11527: bug_actiongroup: tag_attach_threshold not checked When using the actiongroup feature of MantisBT (checking multiple issues and performing an action on all checked issue at the same time), the "Attach tags" feature doesn't check tag_attach_threshold when validating which bugs can be modified. This leads to an access denied error from bug_attach_tags(). --- bug_actiongroup_attach_tags_inc.php | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/bug_actiongroup_attach_tags_inc.php b/bug_actiongroup_attach_tags_inc.php index 86fdd6b27e..518be0d26c 100644 --- a/bug_actiongroup_attach_tags_inc.php +++ b/bug_actiongroup_attach_tags_inc.php @@ -65,24 +65,31 @@ function action_attach_tags_validate( $p_bug_id ) { $g_action_attach_tags_failed = array(); $t_tags = tag_parse_string( $f_tag_string ); + $t_can_attach = access_has_bug_level( config_get( 'tag_attach_threshold' ), $p_bug_id ); $t_can_create = access_has_global_level( config_get( 'tag_create_threshold' ) ); foreach ( $t_tags as $t_tag_row ) { if ( -1 == $t_tag_row['id'] ) { - if ( $t_can_create ) { + if ( $t_can_create && $t_can_attach ) { $g_action_attach_tags_create[] = $t_tag_row; } else { $g_action_attach_tags_failed[] = $t_tag_row; } } else if ( -2 == $t_tag_row['id'] ) { $g_action_attach_tags_failed[] = $t_tag_row; - } else { + } else if ( $t_can_attach ) { $g_action_attach_tags_attach[] = $t_tag_row; + } else { + $g_action_attach_tags_failed[] = $t_tag_row; } } if ( 0 < $f_tag_select && tag_exists( $f_tag_select ) ) { - $g_action_attach_tags_attach[] = tag_get( $f_tag_select ); + if ( $t_can_attach ) { + $g_action_attach_tags_attach[] = tag_get( $f_tag_select ); + } else { + $g_action_attach_tags_failed[] = tag_get( $f_tag_select ); + } } }