438351 - Can't tell that a bug is not public if CCed on it - can't see group memberships

Status: RESOLVED WORKSFORME

(Bugzilla :: User Accounts, defect)

Description

[Gervase Markham [:gerv]]

I was recently CCed on a bug, the initial comment of which was a private email from me to the bug filer. As far as the UI told me, this bug was public.

I was about to write an upset email to the bug filer. But then I realised that I also couldn't normally see the product in question. This is somewhat surprising, as I'm a b.m.o. admin. But that's a a separate issue. 

So I went digging in the groups list, and found a group with the same name as the product. So I began to suspect that my bug was, in fact, a member of this group. I'm not a member, so the UI gives me no indication of this (there was no group checkbox). Once I came to suspect this, the only way I could verify it was by logging out and trying to access the bug again.

My point:
- Bugs which are in groups should tell all users who can see them what groups they are in, even if those users do not have the right to change those groups. Perhaps it's a small privacy leak of the group name, but me sending this guy an angry email is the alternative (and, IMO, worse) downside.

Gerv

Comment 1

[Reed Loden [:reed]]

You'll see this text even though you can't see the group name:

Only members of a group can change the visibility of a bug for that group

Users in the roles selected below can always view this bug:
(The assignee and QA contact can always see a bug, and this section does not take effect unless the bug is restricted to at least one group.)

Reporter CC List

...

Comment 2

[Frédéric Buclin]

Yes, reed is right. You can always know if the bug is restricted to a group.

Comment 3

[Gervase Markham [:gerv]]

I grant that this text appears, but it doesn't exactly scream "I'm in a group" - I'm a Bugzilla dev, and I didn't work it out.

Would there be a privacy problem in showing what groups the bug was in, even if you weren't permitted to change them?

Or add to the message, like so: "This bug is in one or more groups of which you are not a member. Only members of a group can change the visibility of a bug for that group."

Gerv