125492 - Any group member can change the group security on a bug

Status: RESOLVED DUPLICATE of bug 90477

(Bugzilla :: Creating/Changing Bugs, enhancement, P2)

Description

[Mehdi Lavasani]

The ordinary member of a  specific group who hasn't got any premission beside 
viewing the bug is able to make the bug public. I think  this a major security 
problem in bugzilla.

Comment 1

[timeless]

The approach that bugzilla took as a practical approach. Anyone who can see a bug can copy it and upload it to slashdot or anywhere else. Security bugs are on a trust system, if you don't trust someone to do the right thing, then you shouldn't cc them to the bug.

Resolution: CantFix

Comment 2

[Dave Miller [:justdave]]

damnit timeless, don't do that, now I have to do my edit all over again.

Comment 3

[Dave Miller [:justdave]]

I've often thought about that myself...

For mozilla.org this is probably okay, but I can imagine situations with
Syndicomm's system where we wouldn't want customers changing groups, so we
probably do need an option to lock this down somehow...

Making this dependent on the group schema change bug (bug 68022) since there's
no point in fixing this until the new schema is there, and we might be able to
work it into the new schema.

Comment 4

[Bradley Baetz (:bbaetz)]

This isn't really hard to do, but theres no point in doing it before the
templatisation of process_bug and show_bug.

Does anyone really have a problem with requiring editbugs for this?

Requiring editbugs is a false sense of security - a user can easily just print
the bug out if they can see it, or copy it onto a piece of paper, or so on.
However, its probably the right thing to do. A user can't change the groupset
for a group that they are not in, and this is just an extention of that.

Comment 5

[Bradley Baetz (:bbaetz)]

Dupe.

*** This bug has been marked as a duplicate of 90477 ***

Comment 6

[Dave Miller [:justdave]]

clearing milestones on DUPLICATE/WONTFIX/WORKSFORME/INVALID bugs (so they'll
show up as needing triage if they get reopened)