Skip to content

Commit

Permalink
Add access check to mc_issue_get() for handler_id
Browse files Browse the repository at this point in the history
Disclose the handler id only if the user has the appropriate access level to see such information.

Issue #16993
  • Loading branch information
vboctor committed Oct 22, 2014
1 parent bcd976b commit d7e16cc
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion api/soap/mc_issue_api.php
Expand Up @@ -115,7 +115,9 @@ function mc_issue_get( $p_username, $p_password, $p_issue_id ) {
$t_issue_data['sponsorship_total'] = $t_bug->sponsorship_total;

if( !empty( $t_bug->handler_id ) ) {
$t_issue_data['handler'] = mci_account_get_array_by_id( $t_bug->handler_id );
if( access_has_bug_level( config_get( 'view_handler_threshold', null, null, $t_project_id ), $p_issue_id, $t_user_id ) ) {
$t_issue_data['handler'] = mci_account_get_array_by_id( $t_bug->handler_id );
}
}

$t_issue_data['projection'] = mci_enum_get_array_by_id( $t_bug->projection, 'projection', $t_lang );
Expand Down

0 comments on commit d7e16cc

Please sign in to comment.