1251571 - Attachment of security issues are indistinguishable from any other attachment.

Status: RESOLVED WONTFIX

(bugzilla.mozilla.org :: General, defect)

Description

[Nicolas B. Pierron [:nbp]]

Recently, somebody posted a link to IRC which target is an attachment of a security issue (attachment 8709947 [details] [diff] [review], Bug 1238592).

The request I have, is that when I click on the link, while I am already logged in on bugzilla, I have no idea if the content I am reading can safely be discussed publicly, or copied to a pastebin.

I suggest that, in a similar way as we do for security issues, that we should change the background color of the attachments, to reflect the visibility of the attachment (private attachment) and the visibility of the bug (security / confidential).

Comment 1

[David Lawrence [:dkl]]

Attachment: 1251571_1.patch

Comment 2

[:glob ✱]

Comment on attachment 8730933 [details] [diff] [review]
1251571_1.patch

Review of attachment 8730933 [details] [diff] [review]:
-----------------------------------------------------------------

not sure where to go with this review.
it's a very nice change and as it stands it's an r+, but it doesn't address the issue described by nbp.

he's asking for a change to the background while viewing the attachment's contents.  the example attachment and link he provided is a non-private attachment on a non-public bug, so this patch wouldn't fix the issue as described.  that said, changing the output of an attachment itself isn't something we can do, as it will break anything trying to download the patch to apply it, and wouldn't be applicable to all attachments (eg. an image attached to a security bug).

(time passes)

ok, file another bug with your patch with a summary that indicates that it's to make private attachments more visible when viewing a bug.  no need to ask for another review there; r=glob

given we cannot really do anything for this issue, this bug is likely a WONTFIX, sorry.

Comment 3

[Nicolas B. Pierron [:nbp]]

(In reply to Byron Jones ‹:glob› from comment #2)
> given we cannot really do anything for this issue, this bug is likely a
> WONTFIX, sorry.

Thanks, I did not noticed, but this seems logical.
In the mean time I forwarded the feature request to the BugzillaJS addon [1].

[1] https://github.com/gkoberger/BugzillaJS/issues/121

Comment 4

[:glob ✱]

closing as wontfix.