250605 - Metadata changes on private attachments shown in bugmail to people not in the insidergroup

Status: RESOLVED FIXED

(Bugzilla :: Email Notifications, defect, P2)

Description

[Joel Peshkin]

If an attachment is private, requests and changes to the description, mime-type,
etc.. should also be private.

Best bet is to LEFT JOIN in the attachments when going through the bug, pull the
private flag, and or that into $anyprivate

Comment 1

[Joel Peshkin]

This should be nicely contained within BugMail.pm

If a diff involves an attachment and the attachment is private, then make sure
$anyprivate gets set.

Comment 2

[Joel Peshkin]

Attachment: No difftext on bugmail regarding private attachments

Comment 3

[Joel Peshkin]

This really should wind up on 2.18

Comment 4

[Dave Miller [:justdave]]

This sounds like a case of information leakage?

Comment 5

[Christian Reis]

Comment on attachment 154606 [details] [diff] [review]
No difftext on bugmail regarding private attachments

Looks okay. You could:

- Use user->in_group() instead of keying the user->groups hash
- Perhaps use "insideronly" or something to avoid overloading isprivate to
indicate that it's only visible to isprivate, though IIRC that could be a
common convention in our code.

Simple enough to not require 2r=?

Comment 6

[Dave Miller [:justdave]]

holding approval for release day

Comment 7

[Dave Miller [:justdave]]

clarifying summary so we can tell this apart from bug 253544 on a buglist.

Comment 8

[Dave Miller [:justdave]]

checked in on trunk:

Checking in Bugzilla/BugMail.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/BugMail.pm,v  <--  BugMail.pm
new revision: 1.16; previous revision: 1.15
done

and on 2.18 branch:

Checking in Bugzilla/BugMail.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/BugMail.pm,v  <--  BugMail.pm
new revision: 1.13.2.1; previous revision: 1.13
done

Comment 9

[Dave Miller [:justdave]]

advisory has posted, clearing security flag