505390 - WebService should throw an error if you try to add a private comment in Bug.add_comment but aren't in the insidergroup

Status: RESOLVED FIXED

(Bugzilla :: WebService, defect)

Description

[Max Kanat-Alexander]

Right now if you try to add a private comment via Bug.add_comment, and you aren't in the insidergroup, it just fails silently, which seems like a bit of a security risk to me. (Not a security bug, just something that could cause security issues in Bugzilla clients if they don't account for it, which they really couldn't, since they can't know if a user is an insider or not.)

We should throw an error that you aren't an insider, if you try to set "private => 1" and aren't in the insidergroup.

This is a behavior change for the API, so I'm going to restrict it to 3.4.

Comment 1

[Max Kanat-Alexander]

Attachment: v1

Here we go. This just makes Bugzilla itself do it, which I think is sensible. Tested this with bz_webservice_demo.pl, acts correctly.

Comment 2

[Max Kanat-Alexander]

Attachment: v1 (3.4)

This is a backport for 3.4--we need to add the user error there (that's the only change).

Comment 3

[Frédéric Buclin]

Comment on attachment 389609 [details] [diff] [review]
v1

r=LpSolit

Comment 4

[Frédéric Buclin]

Comment on attachment 389610 [details] [diff] [review]
v1 (3.4)

Looks good. r=LpSolit

Comment 5

[Max Kanat-Alexander]

tip:

Checking in Bugzilla/Bug.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/Bug.pm,v  <--  Bug.pm
new revision: 1.285; previous revision: 1.284
done
Checking in Bugzilla/WebService/Bug.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/WebService/Bug.pm,v  <--  Bug.pm
new revision: 1.39; previous revision: 1.38
done
Checking in Bugzilla/WebService/Constants.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/WebService/Constants.pm,v  <--  Constants.pm
new revision: 1.26; previous revision: 1.25
done


3.4:

Checking in Bugzilla/Bug.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/Bug.pm,v  <--  Bug.pm
new revision: 1.276.2.9; previous revision: 1.276.2.8
done
Checking in Bugzilla/WebService/Bug.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/WebService/Bug.pm,v  <--  Bug.pm
new revision: 1.33.2.3; previous revision: 1.33.2.2
done
Checking in Bugzilla/WebService/Constants.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/WebService/Constants.pm,v  <--  Constants.pm
new revision: 1.24.2.1; previous revision: 1.24
done
Checking in template/en/default/global/user-error.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/global/user-error.html.tmpl,v  <--  user-error.html.tmpl
new revision: 1.276.2.3; previous revision: 1.276.2.2
done

Comment 6

[Max Kanat-Alexander]

Added to the release notes in bug 506500.