buglist.cgi

[Joel Peshkin]

Jacqui Guerrero wrote:

> I am trying to modify buglist.cgi such that certain users can only 
> view and submit bugs for a specific product.  If I have usebuggroups 
> and usebuggroupsentry on, is the product considered a group?  If so, 
> how do I  use UserInGroup to check for the product that the user has 
> access to?

What you are trying to do happens automatically if you use usebuggroups 
and usebuggroupsentry on and you make sure that you either create the 
products after those 2 features are enabled or else make sure there is a 
group named EXACTLY the same as each product.

If you need more protection than that (more control),  you need to use 
2.17.4

You really should not have to do customizations yourself using 
UserInGroup().  If you need to do that, you need to have a very deep 
understanding of how these seurity mechanisms work.  Even when the most 
involved developers make changes in those areas, we inspect each others' 
work very carefully.

-Joel