296894 - Change multiple bugs groupset includes groups that are not associated with any access controls

Status: RESOLVED DUPLICATE of bug 134474

(Bugzilla :: Query/Bug List, defect)

Description

[A. Karl Kornel]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/412 (KHTML, like Gecko) Safari/412
Build Identifier: 

I'm not entirely sure that this is a problem, but it's probably worth bringing up.

If I'm running as an admin, and I search for multiple bugs and pull up the page that allows me to 
change many bugs at once, one of the things that I can change is the groupset, allowing me to add/
remove the selected bugs from one of the 2 non-system groups that I have in my installation.  
However, for all of the products in my installation, access controls are only configured for one of the 
two groups, and yet both groups are listed in the groupset box.  Adding/removing a bug from a group 
without access controls does not seem to do anything, so should the groupset box list groups without 
configured access controls?

Reproducible: Always

Steps to Reproduce:
1. Start a new installation of Bugzilla.  Create two groups (group A and group B), neither of which has a 
regexp and both of which are used for bugs.  Group A contains all admins, and admins can grant 
membership in Group A.  Group B contains all admins and all members of Group A, and admins and 
Group A members can grant membership in Group B.
2. Create a new product and add a component to it.  Once created, edit group access controls.  Set 
Group B controls to Shown/Shown, leave everything else unchecked and N/A.
3. Create multiple bugs, all in the recently-created product/component and all public.
4. Run a search for all NEW/UNCONFIRMED bugs in the product created in (2).  The list should return all 
of the bugs created in (3).  Click on "change several requests at once".
Actual Results:  
In the Groupset section, both Group A and Group B are listed, even though Group A does not have any 
access controls configured, and adding the bug to Group A does not seem to do anything.

Expected Results:  
In the Groupset section, only Group B should be listed, because Group B is the only group that has access 
controls configured.

If I look at an individual bug page, in the section labeled "Only users in all of the selected groups can view 
this request:", only Group B is listed.  With the steps as described above, does anything actually happen if 
bugs are added to Group A?

All of this, including steps etc., assumes that you are logged in as an administrator.  I ran all of this as the 
admin created when my installation was first set up.

Comment 1

[Joel Peshkin]

*** This bug has been marked as a duplicate of 134474 ***