1273172 - need undo / audit-trail for vandalism cleanup

Status: UNCONFIRMED

(Bugzilla :: Administration, task)

Description

[Frank Ch. Eigler]

User Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:46.0) Gecko/20100101 Firefox/46.0
Build ID: 20160503092137

Steps to reproduce:

Allow the general public with a confirmed email access to create a bugzilla account.


Actual results:

One such user turned out to be a vandal.  He/she modified dozens of bugs to change component/etc. fields, probably with some mechanical assistance.  We disabled the account, but now have to undo every change, piece by piece, step by step.


Expected results:

There should be a way of easily undoing such damage to the database, an audit trail as per bug #299164 or bug #363346 or bug #641428.
There should be an easy way of setting ACLs to self-created users, so that by default, they can only do relatively harmless stuff like add comments/bugs, but unable to modify preexisting bugs.
Perhaps an undo function like this can also be helpful for spam removal.

Comment 1

[Frédéric Buclin]

(In reply to Frank Ch. Eigler from comment #0)
> There should be an easy way of setting ACLs to self-created users, so that
> by default, they can only do relatively harmless stuff like add
> comments/bugs, but unable to modify preexisting bugs.

Sourceware Bugzilla gave editbugs privs to all accounts by default, which is why this user has been able to cause so much damage. Fixing the regexp for the editbugs (and canconfirm) group will prevent such problems in the future.


See also bug 387586 which will help track changes made by a user.