805192 - Disable the add calendar option "Mozilla Zimbra" on the production build shipped

Status: VERIFIED FIXED

(Firefox OS Graveyard :: Gaia::Calendar, defect, P3)

Description

[Jason Smith [:jsmith]]

In the add calendar UI, we currently provide an option to add a calendar for Mozilla Zimbra. This is great for helping dogfooders internal to Mozilla, but we shouldn't expose this UI to the general public production build, as:

1) Users don't understand what Mozilla Zimbra is
2) I'm not sure we should exposing where our Zimbra calendars for our work schedules are to the general public. I don't know if that has potential privacy implications if this appeared in a GA build to a typical average joe user and they gained knowledge of our zimbra calendars, tried to get access to it, etc.

I think we should just turn this option off in the GA build to avoid any potential risks that exist.

Comment 1

[James Lal [:lightsofapollo]]

Solution:

The intent is we have some .json file which can be configured with the settings.
We have that setup now but its not really well exposed. I think it would be ideal to document this and have a (custom?) build step for internal Mozilla usage.

2: 

I really don't think there is a security/privacy risk here. With some search engine queries you can find the same information and a whole lot more about our Zimbra setup.

Comment 2

[Mike Connor [:mconnor]]

Concur, this should not ship in a final build.

Comment 3

[Andrew Overholt [:overholt]]

When are we going to get rid of this option?

Comment 4

[James Lal [:lightsofapollo]]

Yes? Do you really want this removed as we ramp up internal testing though?

Comment 5

[Alex Keybl [:akeybl]]

(In reply to James Lal [:lightsofapollo] from comment #4)
> Yes? Do you really want this removed as we ramp up internal testing though?

Please prepare a patch, and we'll land at the beginning of C4.

Comment 6

[James Lal [:lightsofapollo]]

Attachment: Pointer to Github pull request: https://github.com/mozilla-b2g/gaia/pull/6767

Pointer to Github pull-request

Comment 7

[James Lal [:lightsofapollo]]

Needs a bit more testing to ensure when the preset is removed users can still edit their credentials. (We should do that anyway eventually we want to allow third party customization of presets anyway).

Comment 8

[Faramarz Rashed]

:lightsofapollo, can you quickly get this out of the way?  seems pretty simple...

Comment 9

[James Lal [:lightsofapollo]]

There is already a patch for this (see attached) but, I have serious doubts about landing it just to close the bug when it makes internal testers lives easier.

The "fix" is about a 4 line removal with no risks without this preset setting up a Zimbra account internally is somewhat tricky as you need to know the CalDAV entry-point for our internal Zimbra servers (not difficult) but still an extra step that would make testing just that little bit harder...

Comment 10

[Faramarz Rashed]

discussed again in the triage group tonight and we're going to leave it in till at most one week before the release.

Comment 11

[Jason Smith [:jsmith]]

We could probably mitigate the concerns you address + Faramarz's concerns to land things by documenting a dogfooding process we could point dogfooders at.

Probably after that last P1 lands it would be worthwhile to do some advertising for dogfooding at that point with some documented things to try out. If the other "fires" calm down a bit in b2g, I could probably look into this.

Comment 12

[Vivien Nicolas (:vingtetun) (:21) - (NOT reading bugmails, needinfo? please)]

(In reply to James Lal [:lightsofapollo] from comment #9)
> There is already a patch for this (see attached) but, I have serious doubts
> about landing it just to close the bug when it makes internal testers lives
> easier.
> 
> The "fix" is about a 4 line removal with no risks without this preset
> setting up a Zimbra account internally is somewhat tricky as you need to
> know the CalDAV entry-point for our internal Zimbra servers (not difficult)
> but still an extra step that would make testing just that little bit
> harder...

Can't you use build/application-data.js to generate an additional json file that Calendar will use? In build/application-data.js you can access some build flags and so Zimbra can be removed from official build.

Comment 13

[Jason Smith [:jsmith]]

Given that were entering C4 now I'd say let's land the patch. We can find a better way to build flag management later, but let's at least get the blocker portion of this bug closed out.

Comment 14

[Jason Smith [:jsmith]]

Verified on today's build - I'm not seeing Mozilla Zimbra listed anymore.