Open Bug 266148 Opened 20 years ago Updated 11 years ago

Adding non-existent/invalid CC: to a flag type incompatible with restricted bugs

Categories

(Bugzilla :: Attachments & Requests, defect)

Product:
Bugzilla
Component:
Attachments & Requests
Type:
defect
Priority:
Not set
Severity:
minor

Tracking

()

People

(Reporter: kiko, Unassigned)

References

Details

We currently do no validation of flag type CC lists. Since we do a check for the
CC: list when we have restricted attachments or a restricted bug, an invalid CC
list will be kicked silently out without warning. This triggers things like bug
266147. 

I think we should require the CC: added to be a valid Bugzilla account.
The purpose of the CC list is to send messages to mailing lists like
reviewers@bugzilla.org, and such mailing lists often don't and generally
shouldn't have Bugzilla accounts.  It may be worth validating the addresses on
the list for conformity with email address standards, but we shouldn't be
requiring them to be valid Bugzilla account addresses.
Well, unless they are valid Bugzilla accounts, we won't be able to validate if
they can receive email or not; in that case we'll just need to kick that check
off Flag.pm:notify(). I however don't think that is the right thing to do.

I generally think that it simplifies things a lot if anyone that gets email from
Bugzilla should have a Bugzilla account; it's *really* easy to create one and
disable it if you don't want it used. This consistency would make the codebase
tighter.
Blocks: rt-clean-up
I agree -- there's nothing wrong with having disabled Bugzilla accounts for
this, just like we have for nobody@mozilla.org or documentation@bugzilla.org.
OS: Linux → All
Hardware: PC → All
QA Contact: mattyt-bugzilla → default-qa
Assignee: myk → attach-and-request
Now that bug 455814 has been checked in, we could easily add mailing-lists to the CC list at no risk, i.e. we could require that all accounts added to it are valid Bugzilla accounts. Assuming we implement this restriction, what do we do on upgrade for older installations having non-Bugzilla accounts in the CC list? Remove them or automatically create an account for them?
Severity: major → normal
Automatically create a disabled account for them, I think.
Severity: normal → minor
You need to log in before you can comment on or make changes to this bug.