366165 - User history should be filtered to only show the fields the person viewing it is allowed to view

Status: NEW

(Bugzilla :: User Accounts, defect)

Description

[Dave Miller [:justdave]]

Right now, anyone with access to editusers for any reason (say they have bless rights for a group) can view the entire account history for a user, which may include adding and removing from groups the user might not otherwise knew existed, for example.

Comment 1

[Dave Miller [:justdave]]

er, make that view, not edit.  If we show it to them on the editusers page, they should be allowed to see when it was changed.

Comment 2

[Michael Ching]

This seems to affect current versions of Bugzilla.

It appears that anyone with bless rights can view the account history not only for any user with a common group membership, but also any other user by simply changing the user id in the URL.

We have attached a patch we are using which restricts the "View Account History" functionality to users in the "editusers" group, rather than also including it for anyone with bless abilities.  The link is removed in the user list, and an error is thrown if the URL is accessed directly.

Is there a significant use case for users who have "bless" rights but who are not members of the "editusers" group to view a filtered version of the the account history rather than simply removing this option from them?

Comment 3

[Michael Ching]

Attachment: removes account history option for users without editusers access

Comment 4

[Michael Ching]

Attachment: removes account history option for users without editusers access

removes link from user view as well

Comment 5

[Frédéric Buclin]

(In reply to Michael Ching from comment #2)
> Is there a significant use case for users who have "bless" rights but who
> are not members of the "editusers" group to view a filtered version of the
> the account history rather than simply removing this option from them?

Definitely, yes. At bmo, very few users have editusers privileges while it's very common to have bless privs for some groups only, in which case it makes total sense to know who set what for groups you manage.