105629 - End-User / Power-User Logins (aka "allow anonymous bug reports") (aka "create account during enter_bug")

Status: NEW

(Bugzilla :: Creating/Changing Bugs, enhancement, P4)

Description

[Hank Riehl]

We have just started using Bugzilla internally and are quite sure it will be 
terrific for our small development group (good-bye spreadsheets!). We market a 
web-ASP application sold into large corporations serving thousands of users.

We envision, as we get more familiar with Bugzilla, that we would code a link 
to our Bugzilla site right into the app itself, where any user anywhere can 
popup our Bugzilla as easily as they can click on Help. Our objective is to 
collect bugs and RFEs directly from the end-user.

But what we'd like to see to serve this clientele is some sort of "dumb end 
user" point-of-entry; where they can simply and easily report a bug or RFE 
without the daunting query page, account setup, etc. This type of user likely 
won't come back to check on his bug, he just needs a quick, user-friendly way 
to tell us something about our app.

Perhaps this could be a front-end module, where the visitor selects "Just 
Report an Issue" (to get a simplified New-Bug dialog) or "Full System" to go 
into the existing Bugzilla home-page.

Just a thought.

Comment 1

[Myk Melez [:myk] [@mykmelez]]

There are two issues here: a simpler form for entering bugs and a way to enter
them without logging in.

Simpler forms can be implemented using templates have usually been
installation-specific, f.e. the Bugzilla Helper (bug 133559) on
bugzilla.mozilla.org:

http://bugzilla.mozilla.org/enter_bug.cgi?format=guided

Entering bugs without logging in is a common request for which solutions can be
found in the newsgroup netscape.public.mozilla.webtools.  The groups system is
being rewritten for Bugzilla 2.18 (bug 68022), and the rewrite may also make
this possible.

Comment 2

[Dave Miller [:justdave]]

The User Interface component now belongs to Gerv.  Reassigning all UNCONFIRMED
and NEW (but not ASSIGNED) bugs currently owned by Myk (the previous component
owner) to Gerv.

Comment 3

[Dave Miller [:justdave]]

Reassigning back to Myk.  That stuff about Gerv taking over the User Interface
component turned out to be short-lived.  Please pardon our confusion, and I'm
very sorry about the spam.

Comment 4

[Frédéric Buclin]

*** Bug 113978 has been marked as a duplicate of this bug. ***

Comment 5

[Frédéric Buclin]

Updating the bug summary to find this bug more easily.

Comment 8

[Andre Klapper]

(Maemo downstream ticket with potential implementation details by timeless at https://bugs.maemo.org/show_bug.cgi?id=4202 )

Comment 10

[timeless]

as mentioned in comment 8: <https://bugs.maemo.org/show_bug.cgi?id=4202#c0>

Possible implementation for Bugzilla:
1. create a special group anonymous_bugs (use for bugs)
2. create a special user 'anonymous@bugs'  
3. stick anonymous@bugs into anonymous_bugs 
4. a special template is created which checks to see if the target product has
a group access control for anonymous_bugs (shown/na)
5. the template will file the bug w/ the user's bug information but
reporter=anonymous@bugs
6. the template will add a private comment 1 (ideally restricted to
anonymous_bugs, however at present due to Bugzilla limitations it'll have to be
whatever the 'private' group is) with user's private information including a
randomly generated token
7. the token is shown to the reporter
8. if at a later time someone wants to claim they reported the bug, they can
log in and comment in the bug w/ the private token and either we can have
another cgi which fixes the owner, or an admin fixes it.

the template would also need an antispam thing (captcha or whatever).

Comment 12

[Frédéric Buclin]

Making a slight change to what timeless suggested in comment 10:

An email address should always be given by the reporter, even if he doesn't plan to create an account. A confirmation email is sent to this address with a URL that the user would have to click to confirm that his email address is valid and belongs to the expected user (else you could abuse someone else's email address), as we usually do with normal user account creation requests. This would automatically 1) remove the bug from the anonymous_bugs group, and 2) change the reporter from anonymous@bugs to the original reporter. If the bug hasn't been confirmed/validated by the original reporter himself because he ignored the confirmation email or because the email address was invalid, members of the anonymous_bugs group can still make the bug public by removing it from the anonymous_bugs group. But the bug would have no real reporter.

A parameter would be required to be able to disable this feature to prevent spam/abuse. I would also be in favor of some simple captcha to prevent robots from filing bugs.

Comment 13

[Frédéric Buclin]

(In reply to Frédéric Buclin from comment #12)
> spam/abuse. I would also be in favor of some simple captcha to prevent
> robots from filing bugs.

To prevent abuse, we could also log the IP address of the reporter, and limit the number of bugs a anonymous reporter can file per hour from this IP address. If he reaches the limit, we would simply display a message that in order to report more bugs, he must confirm that his email address is valid to remove this restriction.

Comment 14

[Dave Miller [:justdave]]

See also https://twitter.com/sarahsharp/status/687343947052486656