331529 - editusers list should let me search for disabled users

Status: RESOLVED FIXED

(Bugzilla :: Administration, task)

Description

[timeless]

I have administrator privs on a bugzilla and i want to look for disabled users.

steps:
1. load edit users.
2. try to find the list of disabled users.
3. search for all users instead.
4. click the button to view the list

expected results:
at the bottom of editusers in bugzilla is a list of groups to which i can restrict my search, i'd like that list to include "disabled".

actual results:
search is much more painful.

Comment 1

[Christoph Späth]

I want exactly the opposite;-) look only for not disabled users and unfortunaltely have many disabled users in my bugzilla.

So if this issue is done, I'd suggest also to add a possibility to hide disabled users. 

So maybe instead of using the groups list, an additinal checkbox "Restrict search to" and a list box "enabled"/"disabled" users could be added.

Comment 2

[Frédéric Buclin]

(In reply to Christoph Späth from comment #1)
> I want exactly the opposite;-) look only for not disabled users

This is bug 315451.

Comment 3

[Sunil Joshi [:sjoshi]]

Attachment: Patch-v1

This fix has also changed the approach taken in Bug 315451

Comment 4

[Frédéric Buclin]

Comment on attachment 795139 [details] [diff] [review]
Patch-v1

>+            my $userstatus = scalar $cgi->param('userstatus');
>+            detaint_natural($userstatus);
>+            $query .= " $nextCondition profiles.is_enabled = ?";
>             $nextCondition = 'AND';
>+            push(@bindValues, $userstatus);

You must validate user data. Simply calling detaint_natural() is not enough (I could pass a string to abuse Bugzilla). A safer approach would be to do:

$userstatus = $cgi->param('userstatus') ? 1 : 0;

I'm not a fan of the name "userstatus". Maybe $is_enabled would be better.

Comment 5

[Sunil Joshi [:sjoshi]]

Attachment: Patch-v2

Review comments incorporated.

Comment 6

[Simon Green]

Comment on attachment 795142 [details] [diff] [review]
Patch-v2

Rather than a checkbox and a drop down, I think it should be one drop down with three options:

All users
Enabled users only (and selected by default)
Disabled users only

Comment 7

[Sunil Joshi [:sjoshi]]

Attachment: Patch-v3

Removing Checkbox

Comment 8

[Simon Green]

Committing to: bzr+ssh://bzr.mozilla.org/bugzilla/trunk/                       
modified editusers.cgi
modified template/en/default/admin/users/search.html.tmpl
Committed revision 8727.