266148 - Adding non-existent/invalid CC: to a flag type incompatible with restricted bugs

Status: NEW

(Bugzilla :: Attachments & Requests, defect)

Description

[Christian Reis]

We currently do no validation of flag type CC lists. Since we do a check for the
CC: list when we have restricted attachments or a restricted bug, an invalid CC
list will be kicked silently out without warning. This triggers things like bug
266147. 

I think we should require the CC: added to be a valid Bugzilla account.

Comment 1

[Myk Melez [:myk] [@mykmelez]]

The purpose of the CC list is to send messages to mailing lists like
[e-mail], and such mailing lists often don't and generally
shouldn't have Bugzilla accounts.  It may be worth validating the addresses on
the list for conformity with email address standards, but we shouldn't be
requiring them to be valid Bugzilla account addresses.

Comment 2

[Christian Reis]

Well, unless they are valid Bugzilla accounts, we won't be able to validate if
they can receive email or not; in that case we'll just need to kick that check
off Flag.pm:notify(). I however don't think that is the right thing to do.

I generally think that it simplifies things a lot if anyone that gets email from
Bugzilla should have a Bugzilla account; it's *really* easy to create one and
disable it if you don't want it used. This consistency would make the codebase
tighter.

Comment 3

[Max Kanat-Alexander]

I agree -- there's nothing wrong with having disabled Bugzilla accounts for
this, just like we have for [e-mail] or [e-mail].

Comment 4

[Frédéric Buclin]

Now that bug 455814 has been checked in, we could easily add mailing-lists to the CC list at no risk, i.e. we could require that all accounts added to it are valid Bugzilla accounts. Assuming we implement this restriction, what do we do on upgrade for older installations having non-Bugzilla accounts in the CC list? Remove them or automatically create an account for them?

Comment 5

[Max Kanat-Alexander]

Automatically create a disabled account for them, I think.