Issue 1442: Draft change is visible to non-owner in the "Needed By" dependency list of a published change
Status:  Released
Owner: ----
Closed:  Jul 2012
Project Member Reported by david.pu...@sonymobile.com, Jun 13, 2012
************************************************************
***** NOTE: THIS BUG TRACKER IS FOR GERRIT CODE REVIEW *****
***** DO NOT SUBMIT BUGS FOR CHROME, ANDROID, INTERNAL *****
***** ISSUES WITH YOUR COMPANY'S GERRIT SETUP, ETC.    *****
***** THOSE ISSUE BELONG IN DIFFERENT ISSUE TRACKERS!  *****
************************************************************

Affected Version: 2.3 onwards

What steps will reproduce the problem?

1. Set up two user accounts, call them "User A" and "User B".
2. As User A, create a commit and upload it to Gerrit on HEAD:refs/for/master, call it "Change 1".
3. Logged into the web UI as User B, view the review page for Change 1.  There are no dependencies shown in the "Needed By" list.
4. As User A, create another commit on top of the previous commit, and upload it to Gerrit on HEAD:refs/drafts/master, call it "Change 2".
5. Still logged into the web UI as User B, refresh the review page for Change 1.  Now the "Needed By" list includes "Change 2 (DRAFT)".
6.  Click on the change link and an error is displayed: "The page you requested was not found, or you do not have permission to view this page."


What is the expected output? What do you see instead?
User B should not be able to see the User A's draft change in the "Needed By" list.

Please provide any additional information below.

Jul 12, 2012
Project Member #1 edwin.ke...@gmail.com
Fixed by [1].

[1] https://gerrit-review.googlesource.com/36491
Status: Submitted
Labels: FixedIn-2.5
Oct 31, 2012
Project Member #2 edwin.ke...@gmail.com
(No comment was entered for this change.)
Status: Released