95798 - Don't allow empty address to be used.

Status: RESOLVED WORKSFORME

(Bugzilla :: Administration, task, P2)

Description

[Matthew Tuck [:CodeMachine]]

Apparently if an installation has an account with an empty address, people can
add it to CC, make it assignee, etc.

Other installations probably have this, IIRC, since it persists from before we
had UIDs, and we know how people are with sanity checking.

I suggest we should copy the checks in CheckEmailSyntax into DBNameToIdAndCheck,
and return a 0 if it doesn't work, even if it was in the database.  These would
check for empty address among other things even if regexp was lax enough to
allow it.

Comment 1

[timeless]

QA Contact is allowed to be null.
And we're working on allowed reporter to be null.

but Assignee and CC's shouldn't be :-)

Comment 2

[Matthew Tuck [:CodeMachine]]

Well reporter should be able to be null, too.  We already have
[e-mail], right?

Maybe have system options as to whether assignee and QA can be null.

Comment 3

[Myk Melez [:myk] [@mykmelez]]

It's important to distinguish between "null" and a user account with an empty
address.  "null" means there is no user in that role.  A user account with an
empty address means we have data integrity problems, since every user account in
Bugzilla should have an account name that is a valid email address.

Comment 4

[Matthew Tuck [:CodeMachine]]

Moving to new Bugzilla product ...

Comment 5

[Dave Miller [:justdave]]

We are currently trying to wrap up Bugzilla 2.16.  We are now close enough to
release time that anything that wasn't already ranked at P1 isn't going to make
the cut.  Thus this is being retargetted at 2.18.  If you strongly disagree with
this retargetting, please comment, however, be aware that we only have about 2
weeks left to review and test anything at this point, and we intend to devote
this time to the remaining bugs that were designated as release blockers.

Comment 6

[Joel Peshkin]

Unloved bugs targetted for 2.18 but untouched since 9-15-2003 are being
retargeted to 2.20
If you plan to act on one immediately, go ahead and pull it back to 2.18.

Comment 7

[Max Kanat-Alexander]

This bug has not been touched by its owner in over six months, even though it is
targeted to 2.20, for which the freeze is 10 days away. Unsetting the target
milestone, on the assumption that nobody is actually working on it or has any
plans to soon.

If you are the owner, and you plan to work on the bug, please give it a real
target milestone. If you are the owner, and you do *not* plan to work on it,
please reassign it to [e-mail] or a .bugs component owner. If you are
*anybody*, and you get this comment, and *you* plan to work on the bug, please
reassign it to yourself if you have the ability.

Comment 8

[Dave Miller [:justdave]]

Reassigning bugs that I'm not actively working on to the default component owner
in order to try to make some sanity out of my personal buglist.  This doesn't
mean the bug isn't being dealt with, just that I'm not the one doing it.  If you
are dealing with this bug, please assign it to yourself.

Comment 9

[Frédéric Buclin]

You cannot use empty addresses for a very long time, and for installations which still have empty addresses (if any), I don't see what checksetup.pl is supposed to do with these accounts. So closing this bug as WFM.