1196614 - restrict the ability for users with editusers/creategroups to alter admins and the admin group

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: General, defect, P1)

Description

[:glob ✱]

we need to provide tighter restrictions around the admin group:
- ensure only admins can edit other admins
- ensure only admins can edit the admin group
  - editing it directly
  - moving it into or out of other groups

Comment 1

[:glob ✱]

Attachment: 1196614_1.patch

- require admin access to edit admin users, even if you are in editbugs
- likewise you need core-security membership to edit core-security users
- prevent non-admins from editing the admin group, or moving that group into or out of other groups
- and again for core-security

Comment 2

[Reed Loden [:reed]]

What about the other security groups? core-security is not the only one.

Comment 3

[:glob ✱]

(In reply to Reed Loden [:reed] (use needinfo?) from comment #2)
> What about the other security groups? core-security is not the only one.

right now the focus is on the two most important groups - admin and the insider group.

if required we can extend this to other groups later.

Comment 4

[David Lawrence [:dkl]]

Comment on attachment 8650525 [details] [diff] [review]
1196614_1.patch

Review of attachment 8650525 [details] [diff] [review]:
-----------------------------------------------------------------

This looks good and does what is described. I would rather see the restricted group list be in Constants.pm so that as we add more later we have main work done already. I tweaked the patch which I will upload after this and if you like it, you can switch it out. Otherwise feel free to go with this in the meantime. r=dkl

Comment 5

[David Lawrence [:dkl]]

Attachment: 1196614_dkl.patch

Comment 6

[:glob ✱]

Comment on attachment 8651266 [details] [diff] [review]
1196614_dkl.patch

i did think of this, but it needs to be admin ui controlled using group inheritance.  we can expand the scope of this in a later bug.

Comment 7

[:glob ✱]

To ssh://[e-mail]/webtools/bmo/bugzilla.git
   4cc64c9..0b05719  master -> master

i've filed bug 1197678 for the followup work.