Deactivating a product doesn't hide its productseries' bugs
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| Launchpad itself |
Triaged
|
High
|
Unassigned | ||
Bug Description
I used to work for iSwifter, and while I was there we created a private Launchpad project to host some private PPAs for us. At the time we were also considering moving away from Jira, so I filed https:/
I no longer work there, and am no longer a member of the private team, however when I do a search of my own reported bugs I can see the above bug in the result list, including its current status and heat level. This is an information leak of some kind, as I might be able to infer things from it (in this case it's rather innocuous, but I could in principle track where and what bugs I filed people were now working on / discussing).
Related branches
- Colin Watson (community): Approve
-
Diff: 138 lines (+82/-3)2 files modifiedlib/lp/bugs/model/bugtasksearch.py (+27/-3)
lib/lp/registry/tests/test_private_team_visibility.py (+55/-0)
| William Grant (wgrant) wrote | #1 |
| information type: | Private Security → Public |
| William Grant (wgrant) wrote | #2 |
| summary: |
- Search results show bugs I reported but should no longer be able to see - due to leaving private team + Deactivating a product doesn't hide its productseries' bugs |
| Changed in launchpad: | |
| importance: | Undecided → High |
| status: | New → Triaged |
| tags: | added: bugs search series trivial |
| Changed in launchpad: | |
| assignee: | nobody → Ines Almeida (ines-almeida) |
| Changed in launchpad: | |
| status: | Triaged → In Progress |
| Changed in launchpad: | |
| status: | In Progress → Fix Committed |
| Changed in launchpad: | |
| status: | Fix Committed → Triaged |
| status: | Triaged → In Progress |
| Ines Almeida (ines-almeida) wrote | #3 |
| Changed in launchpad: | |
| status: | In Progress → Triaged |
| assignee: | Ines Almeida (ines-almeida) → nobody |
You still have permission to see that bug, but you can't navigate to it because it's on a deactivated project. We normally exclude bugs on inactive projects from searches, but apparently we don't also apply that same check to bugs on series on inactive projects.