1635341 - Can get status of secure bugs by referencing bug

Status: UNCONFIRMED

(Bugzilla :: Bugzilla-General, defect)

Description

[Brendan Early [:mymindstorm]]

User Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:75.0) Gecko/20100101 Firefox/75.0

Steps to reproduce:

1. Create a restricted bug by checking the security box
2. Reference the restricted bug in a public bug
3. Logout
4. Hover over the restricted bug link and you should see the status and title of the restricted bug

Example: https://bugzilla-dev.allizom.org/show_bug.cgi?id=1396254

Actual results:

I was able to see the title and status of the restricted bug.

Expected results:

I should not be able to view any details of the restricted bug.

Comment 1

[Brendan Early [:mymindstorm]]

I made a mistake in the report, you cannot see the title of a restricted bug, just the status.

Comment 2

[Robert Longson [:longsonr]]

So what? What does it tell you that a bug with some number is FIXED or not if you can't tell what that bug is about.

Comment 3

[Brendan Early [:mymindstorm]]

Pretty much. You can't get the bug status from directly going to the bug or via the API.

Comment 4

[Firefox Bug Husbandry Bot]

Because this bug's Severity is normal and has not been changed, and this bug's priority is -- (none,) indicating it has has not been previously triaged, the bug's Severity is being updated to -- (default, untriaged.)