Don't allow brand-new accounts to use the Triage Request Form to self-grant `canconfirm`
Categories
(bugzilla.mozilla.org :: General, enhancement, P2)
Tracking
()
People
(Reporter: dveditz, Unassigned)
Details
(Keywords: bmo-triaged)
Attachments
(1 file)
We already have a problem with new people who join bugzilla and vandalize bugs. Separate from spammers, just people playing around to see how it works (students, bug bounty hunters). We should NOT allow these new people to use the Triage request form to self-grant the ability to change resolutions on bugs that are not their own. "New" accounts should not be allowed to do this. (example instance)
I'm not sure what value of "new" to use. 6 months? 6 weeks?
- At the very least, a "NEW" account trying to load https://bugzilla.mozilla.org/page.cgi?id=triage_request.html should get an error. Dealer's choice whether you make a nice error page for it or just return a 403 Unauthorized
- if you want to get fancy you could hide the "canconfim" line on https://bugzilla.mozilla.org/page.cgi?id=get_permissions.html if the account is "NEW"--if they are they won't know what they're missing.
There are other possible changes (like direct people to chat.mozilla.org to ask people, or set up another "file a bug" form), but I suspect people that new don't even know about canconfirm and would not be asking about it except that page tells them it exists. If new users find out it exists because they're already in chat and someone sends them to that page then the person who sent them can also help if they can't find the link.
|
Reporter | |
Comment 1•2 months ago
|
||
:dkl suggested reusing the _is_new() criteria used to add the "New to Bugzilla" comment badges. That would be a perfectly matching concept.
|
||
Comment 2•2 months ago
|
||
We can re-use the user->is_new property to not show/allow the self-canconfirm for now:
https://github.com/mozilla-bteam/bmo/blob/master/extensions/TagNewUsers/Extension.pm#L192-L203
|
||
Comment 3•2 months ago
|
||
|
|
||
Comment 4•2 months ago
|
||
Authored by https://github.com/dklawren
https://github.com/mozilla-bteam/bmo/commit/1c734cc234ee6348f912b5b8422e707e11d3f8d9
[master] Bug 1989605 - Don't allow brand-new accounts to use the Triage Request Form to self-grant
Description
•