Closed Bug 1259190 Opened 10 years ago Closed 10 years ago

Info about private bug leaked via describeuser

Categories

(Bugzilla :: Bugzilla-General, defect)

Product:
Bugzilla
Component:
Bugzilla-General
Version:
4.4.10
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED INVALID

People

(Reporter: egmont, Unassigned)

Details

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Build ID: 20160317093216 Steps to reproduce: _Without_ being logged in, go to https://bugzilla.gnome.org/show_bug.cgi?id=730817 => Access denied (as expected) https://bugzilla.gnome.org/buglist.cgi?quicksearch=product%3A"gnome-terminal" => 730817 does _not_ show up (as expected; it shows up if logged in) https://bugzilla.gnome.org/page.cgi?id=describeuser.html&login=egmont%40gmail.com => 730817 (its category and summary) _does_ show up Expected results: The describeuser.html page should not disclose the private bug's summary and the patch's description.
Assignee: general → dylan
describeuser is not our code. Please report this bug to GNOME directly.
Assignee: dylan → general
Status: UNCONFIRMED → RESOLVED
Closed: 10 years ago
Resolution: --- → INVALID
Sorry for bothering you then, and thanks for the quick response! Filed https://bugzilla.gnome.org/show_bug.cgi?id=764104.
Removing the security flag as the GNOME bug is public.
Group: bugzilla-security
You need to log in before you can comment on or make changes to this bug.