add a default security group

2 files changed, 14 insertions, 3 deletions

diff --git a/Bugzilla/Config/GroupSecurity.pm b/Bugzilla/Config/GroupSecurity.pm
index f6f824098..1739642db 100644
--- a/Bugzilla/Config/GroupSecurity.pm
+++ b/Bugzilla/Config/GroupSecurity.pm
@@ -34,7 +34,7 @@ sub get_param_list {
       name    => 'insidergroup',
       type    => 's',
       choices => \&get_all_group_names,
-      default => '',
+      default => 'bz_insiders',
       checker => \&check_group
     },
 
diff --git a/Bugzilla/Install.pm b/Bugzilla/Install.pm
index 705a8396c..64fc1580c 100644
--- a/Bugzilla/Install.pm
+++ b/Bugzilla/Install.pm
@@ -257,6 +257,17 @@ use constant SYSTEM_GROUPS => (
     name        => 'bz_can_disable_mfa',
     description => 'Can disable MFA when editing users',
   },
+  {
+    use_for_bugs => 1,
+    name         => 'bz_private',
+    description  => 'Private Bug',
+    inherited_by => ['bz_insiders'],
+  },
+  {
+    name => 'bz_insiders',
+    description =>
+      'Can see private attachments, comments, and bugs (for bugs in bz_private)',
+  },
 );
 
 use constant DEFAULT_CLASSIFICATION =>
@@ -311,8 +322,8 @@ sub update_system_groups {
   foreach my $definition (SYSTEM_GROUPS) {
     my $exists = new Bugzilla::Group({name => $definition->{name}});
     if (!$exists) {
-      $definition->{isbuggroup} = 0;
-      $definition->{silently}   = !$editbugs_exists;
+      $definition->{isbuggroup} = delete $definition->{use_for_bugs} // 0,
+        $definition->{silently} = !$editbugs_exists;
       my $inherited_by = delete $definition->{inherited_by};
       my $created      = Bugzilla::Group->create($definition);