Bug 170519 - The text of cloned bugs leaks email addresses
Summary: The text of cloned bugs leaks email addresses
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Bugzilla
Classification: Community
Component: Bugzilla General
Version: 3.6
Hardware: All
OS: Linux
medium
medium
Target Milestone: 4.2-5
Assignee: Matt Tyson 🤬
QA Contact: tools-bugs
URL:
Whiteboard:
: 650397 651134 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2005-10-12 14:51 UTC by Josh Bressers
Modified: 2018-12-09 06:29 UTC (History)
3 users (show)

Fixed In Version: 4.2.4-6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-11-15 03:53:48 UTC
Embargoed:


Attachments (Terms of Use)

Description Josh Bressers 2005-10-12 14:51:47 UTC
Normally you can only see email addresses for bugzilla users when you are logged
in with a valid account.  When a bug is cloned, the various comments are placed
into the initial comment textbox by default.  As bug 170518 shows, the email
addresses of the people who made the previous comments are leaked.

Comment 1 David Lawrence 2006-04-08 18:03:13 UTC
Red Hat's current Bugzilla version is 2.18. I am moving all older open bugs to
this version. Any bugs against the older versions will need to be verified that
they are still bugs. This will help me also to sort them better.

Comment 2 David Lawrence 2008-09-16 16:53:45 UTC
Red Hat Bugzilla is now using version 3.2 of the Bugzilla codebase and therefore this bug will need to be re-verified against the new release. With the updated code this bug may no longer be relevant or may have been fixed in the new code.
Updating bug version to 3.2.

Comment 3 David Lawrence 2008-12-01 05:17:17 UTC
Verified this is still issue in 3.2. Need to update enter_bug.cgi to clean out email addresses from cloned comments.

Comment 4 David Lawrence 2010-01-15 16:55:02 UTC
Red Hat Bugzilla is now using version 3.4 of the Bugzilla codebase and
therefore this bug will need to be re-verified against the new release. With
the updated code this bug may no longer be relevant or may have been fixed in
the new code. Updating bug version to 3.4.

Comment 5 David Lawrence 2010-08-25 21:42:50 UTC
Red Hat has now upgraded to Bugzilla 3.6 and this bug will now be reassigned to that version. It would be helpful to the Bugzilla Development Team if this bug is verified to still be an issue with the latest version. If it is no longer an issue, then feel free to close, otherwise please comment that it is still a problem and we will try to address the issue as soon as we can.

Thanks
Bugzilla Development Team

Comment 7 Jeff Fearn 🐞 2012-05-30 04:44:06 UTC
As part of the recent Bugzilla 4.2 upgrade the Bugzilla team are cleaning up bugs opened against old versions of Bugzilla. This bug has been flagged as an old bug and will be CLOSED WONTFIX in 7 days time.

If you believe this bug is an issue in the latest Bugzilla version please comment on this bug within 7 days. Doing so will ensure this bug is not closed automatically.

Thanks, the Bugzilla team.

Comment 8 Jeff Fearn 🐞 2012-05-30 04:44:34 UTC
As part of the recent Bugzilla 2.4 upgrade the Bugzilla team are cleaning up bugs opened against old versions of Bugzilla. This bug has been flagged as an old bug and will be CLOSED WONTFIX in 7 days time.

If you believe this bug is an issue in the latest Bugzilla version please comment on this bug within 7 days. Doing so will ensure this bug is not closed automatically.

Thanks, the Bugzilla team.

Comment 9 Josh Bressers 2012-06-04 15:57:19 UTC
This behavior still exists and should probably be fixed.

Comment 10 Simon Green 2012-06-15 00:59:14 UTC
I guess the solution is to put the name instead of the e-mail address in cloned comments. Any change would only affect cloned bugs from that point on, we would not change existing cloned bugs.

  -- simon

Comment 11 Simon Green 2012-06-20 06:00:16 UTC
*** Bug 651134 has been marked as a duplicate of this bug. ***

Comment 12 Jeff Fearn 🐞 2012-06-21 03:53:43 UTC
These bugs have been flagged as still relevant and are being reset to default values for PM consideration.

Comment 13 Simon Green 2012-07-19 05:29:22 UTC
*** Bug 650397 has been marked as a duplicate of this bug. ***


Note You need to log in before you can comment on or make changes to this bug.