1058355 - bugzilla.mozilla.org leaks emails to logged out users in "Latest Activity" search URLs

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: Extensions, defect)

Description

[Matthew McPherrin]

Logged out users shouldn't be able to see emails in Bugzilla.

Viewing a user's profile page (eg, https://bugzilla.mozilla.org/user_profile?user_id=412226 ) when logged out has a "Last Activity" URL; this URL contains the user's email address.

Comment 1

[Matthew McPherrin]

Not just Last Activity:  all of the search links in the User Statistics section too.

Comment 2

[David Lawrence [:dkl]]

Attachment: 1058355_1.patch

rather than fix all of the other cgis that require an email such as query.cgi and request.cgi, i opted to just display read-only values for logged out users.

Comment 3

[:glob ✱]

Comment on attachment 8478794 [details] [diff] [review]
1058355_1.patch

Review of attachment 8478794 [details] [diff] [review]:
-----------------------------------------------------------------

r=glob

none of the lines within IF blocks are indented correctly; fix on commit.

Comment 4

[:glob ✱]

To ssh://[e-mail]/webtools/bmo/bugzilla.git
   d5c1d67..fe5deaa  master -> master

downgrading priority due to the semi-public nature of email addresses on bmo.

Comment 5

[Daniel Veditz [:dveditz]]

Given the public nature of email addresses on bmo (anyone can get an account, we have query APIs that are public) this doesn't meet the criteria for the bug bounty