Bug 2065387 - Ensure more triage owners have access to security bugs - #2720
Conversation
There was a problem hiding this comment.
Pull request overview
Extends security-bug visibility to eligible component triage owners.
Changes:
- Grants qualifying triage owners direct and search visibility.
- Limits access to confidential-group members.
- Updates the Bug Modal explanation.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
Bugzilla/User.pm |
Adds direct visibility checks. |
Bugzilla/Search.pm |
Adds triage-owner search visibility. |
extensions/BugModal/template/en/default/bug_modal/groups.html.tmpl |
Documents the new access rule. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
cgsheeh
left a comment
cgsheeh
left a comment
There was a problem hiding this comment.
This PR seems to revert Bug 1790624, has the original reasoning around the restriction changed?
|
|
||
| # Triage owners can see all bugs in their component, but only if they are | ||
| # also a member of the mozilla-employee-confidential group. | ||
| if ($user->in_group('mozilla-employee-confidential')) { |
There was a problem hiding this comment.
This grants the triage owner visibility into every group-restricted bug in their component, not just security ones (legal, HR, partner-restricted, etc.). Should we restrict this to just sec-related bugs?
There was a problem hiding this comment.
Will address as a follow up bug.
Yes. There was discussion on Slack and dveditz explained why it was removed. So the agreement was that we bring it back but add the extra requirement of being mozilla-employee-confidential. This way when people leave and lose that group they also lose triage owner access. |
No description provided.