40885 - whineatnews.pl doesn't honor group permissions on bugs

Status: RESOLVED WONTFIX

(Bugzilla :: Email Notifications, defect, P1)

Description

[tonyr]

I get one every day but the link always show's zarro boogs found.  

http://bugzilla.mozilla.org/buglist.cgi?bug_status=NEW&assigned_to=
[e-mail]

I'm guessing the problem is a bug assigned to me in the commercial tree that I 
cannot access.

http://bugzilla.mozilla.org/show_bug.cgi?id=36483

Whenever I click the above link all I get is a you don't have permissions to 
access the bug.  So....  bugzilla sends me an email every single day for a bug I 
can't access.

Comment 1

[Matthew Tuck [:CodeMachine]]

Bug #39816 suggests changing the situation so there is an option to let you see
it in more instances, but it's only an option.  It suggests adding a routine
called UserCanSeeBug, and reports should use this routine.

Comment 2

[Dave Miller [:justdave]]

What actually happened in bug 39816 is that there are now checkboxes on the bugs
(if there are groups set on it) to allow the reporter, assignee, qa contact, and
CC list to access the bug, regardless of not being members of the group the bug
is restricted to.  This will default to ON, so any existing bugs that were
restricted that you didn't have access to, but you were listed on, should show
up for you after b.m.o picks up this patch.

Comment 3

[Dave Miller [:justdave]]

Since we're not intending on releasing until b.m.o has been running the 2.14
code for a week or so, we should be able to tell if this is fixed or not before
2.14 releases.

Comment 4

[Matthew Tuck [:CodeMachine]]

This won't have been fixed I think, since it will still send email if
appropriate checkbox is off.

Comment 5

[Dave Miller [:justdave]]

OK, Matty's right.  Back to 2.16.

Comment 6

[Christopher Aillon (sabbatical, not receiving bugmail)]

Mass moving to new product Bugzilla...

Comment 7

[Dave Miller [:justdave]]

This is now on the 2.16 block list.

Comment 8

[Bradley Baetz (:bbaetz)]

taking

Comment 9

[Bradley Baetz (:bbaetz)]

Attachment: patch

Comment 10

[Dave Miller [:justdave]]

Does SelectVisible() know to look up the bugs visibility from the perspective of
the person listed in the login_name column?  Or will it try to look it up from
the perspective of the logged in user (which there isn't one since this is
running from a cron job...)

Comment 11

[Bradley Baetz (:bbaetz)]

Doh. Well, it turns out that the optional arguments to SelectVisible work :) It
would just be finding groupset=0 bugs, in fact.

However, we have a bug to always allow the assignee to see the bug, in which
case this all becomes irrelevent. Maybe we should just fix that bug instead?

Comment 12

[Dave Miller [:justdave]]

hmm, good point.  I agree, let's fix bug 97471 instead.  Bugzilla has no
business preventing you from seeing a bug that's assigned to you (if you're not
supposed to see it, it should be assigned to someone else).

Comment 13

[Dave Miller [:justdave]]

clearing target milestone on resolved non-FIXED bugs so they'll get re-triaged
if they get reopened.