797226 - A-dependent-bug-changed bugmail on an un-hidden bug sometimes exposes the unobscured summary of a dependent hidden bug

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: Extensions, defect)

Description

[Jeff Walden [:Waldo]]

Attachment: Dependency-change email that includes a hidden bug's summary, unobscured

The specific scenario I'm aware of where this happens is this:

* hidden bug A gets marked fixed
* open bug B depends on hidden bug A
* people on the CC list of bug B, with the right mail settings, are sent mail (unencrypted, in the clear) saying that bug B changed state
* the referenced-bugs section will hide bug A's summary, but the main body of the dependency mail includes bug A's summary unhidden

See the attachment for an example.

Comment 1

[David Lawrence [:dkl]]

Attachment: Patch to sanitize subject of blocker bug (v1)

Comment 2

[:glob ✱]

Comment on attachment 686772 [details] [diff] [review]
Patch to sanitize subject of blocker bug (v1)

r=glob

excellent, i really like this fix

Comment 3

[David Lawrence [:dkl]]

Thanks

Committing to: bzr+ssh://[e-mail]/bmo/4.0
modified extensions/SecureMail/Extension.pm
Committed revision 8405.

Committing to: bzr+ssh://[e-mail]/bmo/4.2
modified extensions/SecureMail/Extension.pm
Committed revision 8437.

Comment 4

[Daniel Holbert [:dholbert]]

I saw this in bugmail sent today. Has this been deployed on b.m.o yet? (Is this expected to be fixed in production?)

Comment 5

[David Lawrence [:dkl]]

Unfortunately not yet. still waiting on the code push by IT.

Comment 6

[Jeff Walden [:Waldo]]

If this is fixed, should I ever expect to get bugmail for bug XXXXXX whose contents look like this:

"""
Bug XXXXXX depends on bug YYYYYY, which changed state.

Bug YYYYYY Summary: (Secure bug)
https://bugzilla.mozilla.org/show_bug.cgi?id=YYYYYY

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

Referenced Bugs:

https://bugzilla.mozilla.org/show_bug.cgi?id=YYYYYY
[Bug YYYYYY] The actual bug summary
"""

Because I got an encrypted bugmail with these contents on January 30 this year, and I'd thought that wasn't supposed to happen with this fixed.