366994 - private comments cause bugmail to not be sent to people not in the insider group even if there are public changes

Status: RESOLVED FIXED

(Bugzilla :: Creating/Changing Bugs, defect, P1)

Description

[timeless]

neil filed a bug with a private comment 0. that cheated timeless@gmail (not a security group member) out of a bugmail.

Comment 1

[Max Kanat-Alexander]

I don't know how much re-architecture this would take to fix, but for now I'll say it's a blocker. If we discover that the fix would be very invasive, its blocking status may change.

Comment 2

[Frédéric Buclin]

We have to be very careful about the information to put into the bugmail. We will have to filter all private data (attachment + comments) if the addressee is not in the insider group. Also, in the case of bugmail aggregation, we have to make sure private comments are removed.

Comment 3

[Max Kanat-Alexander]

Okay. Since this is not a regression and would be very complicated to fix, it's not a blocker. But we should really look into it for 3.2.

Comment 4

[Frédéric Buclin]

I still think we can take it for 3.0, despite it's not a blocker.

Comment 5

[Max Kanat-Alexander]

Bugzilla 3.2 is now frozen. Only enhancements blocking 3.2 or specifically approved for 3.2 may be checked in to the 3.2 branch. If you would like to nominate your enhancement for Bugzilla 3.2, set the "blocking3.2" flag to "?". Then, either the target milestone will be changed back, or the blocking3.2 flag will be granted, if we will accept this enhancement for Bugzilla 3.2.

This particular bug has not been touched in over eight months, and thus is being retargeted to "---" instead of "Bugzilla 4.0". If you believe this is a mistake, feel free to retarget it to Bugzilla 4.0.

Comment 6

[Max Kanat-Alexander]

Attachment: v1

Wow, this was surprisingly simple to fix.

Comment 7

[Max Kanat-Alexander]

This actually wasn't just happening with the "New:" bugmail, it was happening with all bugmail.

Comment 8

[Max Kanat-Alexander]

By the way, lest anybody suggest we take this for 3.4: I know that it's sort of a bug fix, but it's also a significant security change in the way that Bugzilla works, so I don't want to spring that on people during a stable branch.

Comment 9

[David Lawrence [:dkl]]

Comment on attachment 409047 [details] [diff] [review]
v1

Ok I have verified that this patch works and that public changes are still delivered to non-insider even when comment and/or attachment is set to private. Code looks fine to me as well. r=dkl

Comment 10

[Max Kanat-Alexander]

Checking in Bugzilla/BugMail.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/BugMail.pm,v  <--  BugMail.pm
new revision: 1.130; previous revision: 1.129
done

Comment 11

[Max Kanat-Alexander]

Added to the release notes in bug 547466.

Comment 12

[Adam Batkin]

I know it's a little late now, but I just noticed this in the release notes for 3.6. I wonder if this fix is a good idea?

For us, it is definitely a regression, as we relied on the ability to make changes to a bug without notifying people, by also including a Private comment. It may have been hackish, but it worked, and now there is no way (that I know of) to do that.

Comment 13

[Frédéric Buclin]

Hiding changes to people is bad thing. It's not your role to decide what other users want to get as notifications or not. Especially when you know that your changes are not secret as they are visible in the bug history. So yes, fixing this bug was a good and necessary thing.