656716 - [e-mail] spammed a bunch of blocking flags without editbugs

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: Administration, task)

Description

[Benjamin Smedberg]

[e-mail] made a bunch of unwelcome blocking nominations, such as in https://bugzilla.mozilla.org/show_activity.cgi?id=409737. But according to his user history, his editbugs privs were revoked 2010.05.24, and those flags are supposed to be limited to users with editbugs privileges.

Can we check and see whether the flags are configured correctly, or how this spammage happened?

Comment 1

[Reed Loden [:reed]]

The ability to nominate blocking flags is not restricted to certain groups (and has never been). However, if [e-mail] has done this before, his/her account could just be disabled.

Comment 2

[Marcia Knous [:marcia]]

He was also mucking about in https://bugzilla.mozilla.org/show_activity.cgi?id=656269 today.

Comment 3

[Benjamin Smedberg]

Per bug 648555, the tracking flags should be nominatable by only people with editbugs. Can we please make that change? I will deal with this particular instance separately, I don't think revoking the account is warranted (yet).

Comment 4

[Marcia Knous [:marcia]]

I seem to be getting a lot of bugmail today where he is making flag changes. https://bugzilla.mozilla.org/show_activity.cgi?id=572661 is another example.

Comment 5

[David Lawrence [:dkl]]

Reopened bug 648555 as it needs some work to block users from requesting who are not in the 'editbugs' group.

dkl

Comment 6

[Daniel Veditz [:dveditz]]

(In reply to comment #1)
> The ability to nominate blocking flags is not restricted to certain groups
> (and has never been). However, if [e-mail] has done this
> before, his/her account could just be disabled.

I don't see it documented anywhere "don't nominate things unless you know what you're doing", and in fact we invite our beta audience (on branches, anyway) to over-nominate out of fear we'll miss something important. Unless (s)he's been explicitly warned disabling the account doesn't seem fair, it looked like a good-faith effort to advocate for certain bugs.

Comment 7

[:glob ✱]

https://bugzilla.mozilla.org/page.cgi?id=user_activity.html&action=run&who=obsolete.fax%40gmail.com&from=2011-05-01&to=2011-05-16

something which concerns me is the clearing of a bunch of flags at the end of the report.

the current flag security code allows for this, however i'm not sure if this is by design or a bug.

to me it makes sense that if only trusted accounts can set the flag, then likewise only trusted accounts should be able to clear the flag once set.

Comment 8

[David Lawrence [:dkl]]

Attachment: Patch to require privs to unset a set tracking flag (v1)

First crack at this issue. The patch basically requires the user to have empowerment if they are either setting a flag to a value other then ---, ? or to set it back to ---, ? from a granted state.

dkl

Comment 9

[:glob ✱]

(In reply to comment #8)
> Attachment #532867 [details] [diff] Flags: review?([e-mail])
> Patch to require privs to unset a set tracking flag (v1)

i'll hold off on the review until we have feedback that this is the desired behavour.

Comment 10

[Benjamin Smedberg]

That sounds reasonable, but I still believe we should just require editbugs to set the flag.

FWIW, I mailed obsolete.fax directly, and after some discussion I do not believe that he will be changing the tracking flags in the future.

Comment 11

[:glob ✱]

Comment on attachment 532867 [details] [diff] [review]
Patch to require privs to unset a set tracking flag (v1)

r=glob

Comment 12

[David Lawrence [:dkl]]

(In reply to comment #10)
> That sounds reasonable, but I still believe we should just require editbugs
> to set the flag.

Yeah this patch fixes a different issue in that I feel that only people of privilege should be able to un-GRANT a flag once it has been set. 

The original issue you were concerned with is the ability to nominate the flag in the first place.

dkl

Comment 13

[David Lawrence [:dkl]]

(In reply to comment #11)
> Comment on attachment 532867 [details] [diff] [review] [review]
> Patch to require privs to unset a set tracking flag (v1)
> 
> r=glob

Committing to: bzr+ssh://[e-mail]/bmo/4.0
modified extensions/BMO/Extension.pm
Committed revision 7705

dkl

Comment 14

[David Lawrence [:dkl]]

Open a new bug if there is still any issues related to tracking flags.

dkl