Bug 1298357 - Return username component of email via RPC if no 'Real Name' is set.
Summary: Return username component of email via RPC if no 'Real Name' is set.
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Bugzilla
Classification: Community
Component: WebService
Version: 4.4
Hardware: All
OS: All
medium
high vote
Target Milestone: 4.4
Assignee: Matt Tyson 🤬
QA Contact: tools-bugs
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-01-13 21:48 UTC by Adam Williamson
Modified: 2018-12-09 06:29 UTC (History)
5 users (show)

Fixed In Version: 4.4.11048.2
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-02-15 00:57:12 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 447765 0 low CLOSED Sanitize email addresses from bug reports, attachments, activity for non-logged-in users 2021-02-22 00:41:40 UTC

Description Adam Williamson 2016-01-13 21:48:42 UTC
Per https://bugzilla.redhat.com/docs/en/html/api/Bugzilla/WebService/Bug.html :
     
creator

    string The login name of the person who filed this bug (the reporter).

As documented there, until recently, the RHBZ XMLRPC API did indeed return the 'login name' (email address) of the bug's reporter as the 'creator'. However, at some point since December 12, this changed. It is now returning the reporter's display name instead, and for some bugs - e.g. https://bugzilla.redhat.com/show_bug.cgi?id=1257553 - it does not return anything (python-bugzilla converts this to an empty string).

This obviously breaks code which expects to get back the user's login name, for example, a script we (Fedora QA) use to generate some statistics about Fedora bug reports.

The code in question uses python-bugzilla, but I've verified this is not a python-bugzilla issue, it's a Bugzilla issue. Using the examples from http://blog.likewise.org/2013/09/using-curl-to-access-bugzillas-xml-rpc-api/ , here's a proof:

1. Giving the display name instead of the email address (using bug #1257554):

curl --silent --insecure   https://bugzilla.redhat.com/xmlrpc.cgi   -H "Content-Type: text/xml"   -d "<?xml version='1.0' encoding='UTF-8'?><methodCall><methodName>Bug.get</methodName> <params><param><value><struct><member><name>ids</name><value>1257554</value></member></struct></value></param> </params> </methodCall>"   | xpath '//name[contains(text(), "creator")]/../value/string/text()'
Found 1 nodes:
-- NODE --
Yeela Kaplan

2. Returning no 'creator' at all (using #1257553):

curl --silent --insecure   https://bugzilla.redhat.com/xmlrpc.cgi   -H "Content-Type: text/xml"   -d "<?xml version='1.0' encoding='UTF-8'?><methodCall><methodName>Bug.get</methodName> <params><param><value><struct><member><name>ids</name><value>1257553</value></member></struct></value></param> </params> </methodCall>"   | xpath '//name[contains(text(), "creator")]/../value/string/text()'
No nodes found

Note that Mozilla's bugzilla does not have this problem, it is still returning the email address ('login name'):

curl --silent --insecure   https://bugzilla.mozilla.org/xmlrpc.cgi   -H "Content-Type: text/xml"   -d "<?xml version='1.0' encoding='UTF-8'?><methodCall><methodName>Bug.get</methodName> <params><param><value><struct><member><name>ids</name><value>50000</value></member></struct></value></param> </params> </methodCall>"   | xpath '//name[contains(text(), "creator")]/../value/string/text()'
Found 1 nodes:
-- NODE --
nasiruddin.shaikh.com

so either this is specific to RHBZ, or Mozilla is running an older version before this got broken or a later version and it got fixed again...

Comment 1 Matt Tyson 🤬 2016-01-14 06:21:18 UTC
This is happening because you are not logged in to Bugzilla.  If you make the same API call from an account that is logged in, you will get the email address.

We have a customization that will hide email addresses unless you are logged in.  This was implemented in an attempt to cut down on email address harvesting.

Comment 2 Adam Williamson 2016-01-14 07:18:57 UTC
Then the documentation should explain this correctly, and in any case, I don't think it's reasonable for the API to return no value, you did not explain that; even if there's no display name for an account, it should return *something*, for instance, the local part of the email address.

Comment 3 Matt Tyson 🤬 2016-01-14 22:44:51 UTC
(In reply to awilliam from comment #2)
> Then the documentation should explain this correctly

That's reasonable. I'll update the docs.

> and in any case, I
> don't think it's reasonable for the API to return no value.

The API does return a value.  It returns the user's full name.

Comment 4 Adam Williamson 2016-01-15 00:43:58 UTC
Did you see the example of bug #1257553? When you request the 'creator' without being logged in, you get...nothing at all. I'm guessing this is because Joerg's account doesn't have a full name set, but I don't think it's reasonable to return nothing in this case.

Specifically, think of the script I'm actually working with here: it's designed to count bug reports per reporter. If Bugzilla just returns nothing when the reporter has no display name, then *all* the reports for *all* reporters with no display name will be counted together, and I (the person consuming the results) have absolutely no idea who any of those bugs was reported by. Using the local part of the email address (i.e. 'joerg.lechner' in that case - the part before the @) would go a long way to solving those problems; OK, maybe sometimes we'd get unlucky and two reporters would have the same one, but it's much better than what it does now.

Comment 5 Matt Tyson 🤬 2016-01-15 01:12:55 UTC
(In reply to awilliam from comment #4)
> Using the local part of the email address (i.e. 'joerg.lechner'
> in that case - the part before the @) would go a long way to solving those
> problems; OK, maybe sometimes we'd get unlucky and two reporters would have
> the same one, but it's much better than what it does now.

On closer inspection, this is what the web UI does when you view the bug and are not logged in.

I'll update the RPC interface to be consistent with this.

Comment 6 Hui Wang 2016-01-25 05:56:27 UTC
Verified the issue.
The result is PASS.
version 4.4.11048.1
Steps:
curl --silent --insecure   https://bzperfweb01.app.qa.eng.nay.redhat.com/xmlrpc.cgi   -H "Content-Type: text/xml"   -d "<?xml version='1.0' encoding='UTF-8'?><methodCall><methodName>Bug.get</methodName> <params><param><value><struct><member><name>ids</name><value>1257553</value></member></struct></value></param> </params> </methodCall>"   | xpath '//name[contains(text(), "creator")]/../value/string/text()'
Found 1 nodes:
-- NODE --
joerg.lechner

Comment 7 Matt Tyson 🤬 2016-02-15 00:57:12 UTC
This change is now live. If there are any issues, do not reopen this bug.
Instead, you should create a new bug and reference this bug.


Note You need to log in before you can comment on or make changes to this bug.