Skip to content

Bug 2065387 - Ensure more triage owners have access to security bugs #2720

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dklawren merged 3 commits into from
Aug 25, 2026
Merged

Bug 2065387 - Ensure more triage owners have access to security bugs #2720

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
efd6728
Bug 2065387 - Ensure more triage owners have access to security bugs
dklawren Aug 21, 2026
51660a7
Copilot review fixes
dklawren Aug 21, 2026
765110b
Review fixes
dklawren Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions Bugzilla/Search.pm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1458,6 +1458,20 @@ sub _standard_joins {
extra => ['security_cc.who = ' . $user->id],
};
push @joins, $security_cc_join;

# Triage owners can see all bugs in their component, but only if they are
# also a member of the mozilla-employee-confidential group.
if ($user->is_employee_confidential) {
my $security_triage_join = {
table => 'components',
as => 'security_triage',
from => 'bugs.component_id',
to => 'id',
join => 'LEFT',
extra => ['security_triage.triage_owner_id = ' . $user->id],
};
push @joins, $security_triage_join;
}
}

return @joins;
Expand Down Expand Up @@ -1538,6 +1552,12 @@ sub _standard_where {
if (Bugzilla->params->{'useqacontact'}) {
push @involved, ("bugs.qa_contact = $userid");
}

# This must stay in sync with the security_triage join in _standard_joins,
# which is only present for confidential-group members.
if ($self->_user->is_employee_confidential) {
push @involved, ('security_triage.triage_owner_id IS NOT NULL');
}
$term .= ' OR (' . join(') OR (', @involved) . ')';
}

Expand Down
35 changes: 29 additions & 6 deletions Bugzilla/User.pm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1548,12 +1548,14 @@ sub visible_bugs {
# same result for bug_group_map.bug_id (so DISTINCT filters
# out duplicate rows).
"SELECT DISTINCT bugs.bug_id, reporter, assigned_to, qa_contact,
reporter_accessible, cclist_accessible, cc.who,
bug_group_map.bug_id
components.triage_owner_id, reporter_accessible,
cclist_accessible, cc.who, bug_group_map.bug_id
FROM bugs
LEFT JOIN cc
ON cc.bug_id = bugs.bug_id
AND cc.who = $user_id
LEFT JOIN components
ON bugs.component_id = components.id
LEFT JOIN bug_group_map
ON bugs.bug_id = bug_group_map.bug_id
AND bug_group_map.group_id NOT IN ("
Expand All @@ -1567,13 +1569,20 @@ sub visible_bugs {

$sth->execute(@check_ids);
my $use_qa_contact = Bugzilla->params->{'useqacontact'};

# Triage owners can see all bugs in their component, but only if they are
# also a member of the mozilla-employee-confidential group.
my $use_triage_owner = $self->is_employee_confidential;
while (my $row = $sth->fetchrow_arrayref) {
my ($bug_id, $reporter, $owner, $qacontact, $reporter_access, $cclist_access,
$isoncclist, $missinggroup)
= @$row;
my (
$bug_id, $reporter, $owner,
$qacontact, $triage_owner, $reporter_access,
$cclist_access, $isoncclist, $missinggroup
) = @$row;
$visible_cache->{$bug_id}
||= ((($reporter == $user_id) && $reporter_access)
|| ($use_qa_contact && $qacontact && ($qacontact == $user_id))
|| ($use_qa_contact && $qacontact && ($qacontact == $user_id))
|| ($use_triage_owner && $triage_owner && ($triage_owner == $user_id))
|| ($owner == $user_id)
|| ($isoncclist && $cclist_access)
|| !$missinggroup) ? 1 : 0;
Expand Down Expand Up @@ -2580,6 +2589,16 @@ sub is_insider {
return $self->{'is_insider'};
}

sub is_employee_confidential {
my $self = shift;

if (!defined $self->{'is_employee_confidential'}) {
$self->{'is_employee_confidential'}
= $self->in_group('mozilla-employee-confidential') ? 1 : 0;
}
return $self->{'is_employee_confidential'};
}

sub is_global_watcher {
my $self = shift;

Expand Down Expand Up @@ -3482,6 +3501,10 @@ for flag mail.
Returns true if the user can access private comments and attachments,
i.e. if the 'insidergroup' parameter is set and the user belongs to this group.

=item C<is_employee_confidential>

Returns true if the user belongs to the 'mozilla-employee-confidential' group.

=item C<is_global_watcher>

Returns true if the user is a global watcher,
Expand Down
5 changes: 3 additions & 2 deletions extensions/BugModal/template/en/default/bug_modal/groups.html.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,8 +108,9 @@
[% " disabled=\"disabled\"" UNLESS user_can_edit_accessible %]>
<label for="cclist_accessible">CC List</label>
</div>
The assignee [% IF (Param('useqacontact')) %]and QA contact[% END %]
can always see [% terms.abug %], and this section does not take effect
The assignee[% IF (Param('useqacontact')) %], QA contact,[% END %]
and triage owner (when a member of mozilla-employee-confidential) can
always see [% terms.abug %], and this section does not take effect
unless the [% terms.bug %] is restricted to at least one group.
[% END %]
</div>
Loading