Bug #60989 [Com]: logged in users can't access the security bugs reported by them

Edit report at https://bugs.php.net/bug.php?id=60989&edit=1 ID: 60989 Comment by: tyrael@php.net Reported by: tyrael@php.net Summary: logged in users can't access the security bugs reported by them Status: Open Type: Bug Package: Website problem PHP Version: Irrelevant Block user comment: N Private report: N New Comment: the attached patch should solve the issues. I tested it on my local developer environment and it seemed to work just fine, but given the recent events, I would like somebody to review it, before I push it. Previous Comments: ------------------------------------------------------------------------ [2012-05-05 20:25:11] tyrael@php.net The following patch has been added/updated: Patch Name: bugsweb-security.diff Revision: 1336249511 URL: https://bugs.php.net/patch-display.php?bug=60989&patch=bugsweb-security.diff&revision=1336249511 ------------------------------------------------------------------------ [2012-05-05 18:35:52] tyrael@php.net so I would like to propose these changes: - logged in users should be able to access the private bugs reported by them. - only the reporter and the $security_developers should be able to see the quick summary of the private bugs. (summary, Submitted, Modified, From, Assigned, Status, Package, PHP version, OS, CVE-ID would be hidden or asterixed out) - the view tab should only contain the 'This bug report is marked as private.' message for non authorized people (non security dev nor reporter) - the developer tab for logged but non authorized people should only contain the 'This bug report is marked as private.' (currently it contains the 'This bug report is marked as private.' checkbox, 'Quick Fix' dropdown and the 'Block user comment' checkbox ) ------------------------------------------------------------------------ [2012-02-06 11:24:46] tyrael@php.net Description: ------------ I just reported a few security issues, and noticed that: - anybody can access the basic information about the private/security bugs (summary, Submitted, Modified, From, Assigned, Status, Package, PHP version, OS, CVE-ID). - logged in users can't access the bug, they are still asked for a password, which they don't have, as they didn't had to provide that at the original report. - I'm not sure that it is a bug, or just a mail delivery issue, but when I tried to recover the password through the bug-pwd-finder.php, it said it was successful ("The password for bug report #60988 has been sent to tyrael@php.net"), but I didn't get any mail. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=60989&edit=1