Bug 219021: Only display email addresses to logged-in users

Patch By Max Kanat-Alexander <mkanat@bugzilla.org> r=LpSolit, a=LpSolit

7 files changed, 60 insertions, 78 deletions

diff --git a/template/en/default/bug/activity/table.html.tmpl b/template/en/default/bug/activity/table.html.tmpl
index b676eb1c9..8e44230ae 100644
--- a/template/en/default/bug/activity/table.html.tmpl
+++ b/template/en/default/bug/activity/table.html.tmpl
@@ -61,7 +61,7 @@
     [% FOREACH operation = operations %]
       <tr>
         <td rowspan="[% operation.changes.size %]" valign="top">
-          [% operation.who FILTER html %]
+          [% operation.who FILTER email FILTER html %]
         </td>
         <td rowspan="[% operation.changes.size %]" valign="top">
           [% operation.when FILTER time %]
@@ -89,7 +89,7 @@
                          change.fieldname == 'dependson' %]
                   [% change.removed FILTER bug_list_link FILTER none %]
                 [% ELSE %]
-                  [% change.removed FILTER html %]
+                  [% change.removed FILTER email FILTER html %]
                 [% END %]
               [% ELSE %]
                 &nbsp;
@@ -109,7 +109,7 @@
                          change.fieldname == 'dependson' %]
                   [% change.added FILTER bug_list_link FILTER none %]
                 [% ELSE %]
-                  [% change.added FILTER html %]
+                  [% change.added FILTER email FILTER html %]
                 [% END %]
               [% ELSE %]
                 &nbsp;
diff --git a/template/en/default/bug/comments.html.tmpl b/template/en/default/bug/comments.html.tmpl
index 1e8ee8c54..3a30ca5b2 100644
--- a/template/en/default/bug/comments.html.tmpl
+++ b/template/en/default/bug/comments.html.tmpl
@@ -188,11 +188,7 @@
         </span>
 
         <span class="bz_comment_user">
-          <span class="vcard">
-            <a class="fn email" 
-               href="mailto:[% comment.author.email FILTER html %]">
-              [% (comment.author.name || comment.author.login) FILTER html %]</a>
-          </span>
+          [% INCLUDE global/user.html.tmpl who = comment.author %]
         </span>
 
         <span class="bz_comment_user_images">
@@ -226,7 +222,8 @@
 [% END %]
 <pre class="bz_comment_text" 
      [% ' id="comment_text_' _ count _ '"' IF mode == "edit" %]>
-  [%- wrapped_comment FILTER quoteUrls(bug.bug_id, comment.already_wrapped) -%]
+  [%- wrapped_comment FILTER email 
+                      FILTER quoteUrls(bug.bug_id, comment.already_wrapped) -%]
 </pre>
     </div>
   [% END %]
diff --git a/template/en/default/bug/dependency-tree.html.tmpl b/template/en/default/bug/dependency-tree.html.tmpl
index adabf8ea2..347478bfc 100644
--- a/template/en/default/bug/dependency-tree.html.tmpl
+++ b/template/en/default/bug/dependency-tree.html.tmpl
@@ -154,7 +154,7 @@
 
 [% BLOCK buginfo %]
   [% get_status(bug.bug_status) FILTER html -%] [%+ get_resolution(bug.resolution) FILTER html %];
-  [%-%] assigned to [% bug.assigned_to.login FILTER html %]
+  [%-%] assigned to [% bug.assigned_to.login FILTER email FILTER html %]
   [%-%][% "; Target: " _ bug.target_milestone IF bug.target_milestone %]
 [% END %]
 
diff --git a/template/en/default/bug/edit.html.tmpl b/template/en/default/bug/edit.html.tmpl
index 50c7ea9d5..bb80fc1ad 100644
--- a/template/en/default/bug/edit.html.tmpl
+++ b/template/en/default/bug/edit.html.tmpl
@@ -524,7 +524,7 @@
         [% IF bug.check_can_change_field("assigned_to", 0, 1) %]
           <div id="bz_assignee_edit_container" class="bz_default_hidden">
             <span>
-              [% INCLUDE user_identity user=> bug.assigned_to %]
+              [% INCLUDE global/user.html.tmpl who = bug.assigned_to %]
               (<a href="#" id="bz_assignee_edit_action">edit</a>)
             </span>
           </div>
@@ -548,7 +548,7 @@
            initDefaultCheckbox('assignee');                  
           </script>
         [% ELSE %]
-          [% INCLUDE user_identity user => bug.assigned_to %]
+          [% INCLUDE global/user.html.tmpl who = bug.assigned_to %]
         [% END %]
       </td>
     </tr>
@@ -559,13 +559,12 @@
         <label for="qa_contact" accesskey="q"><b><u>Q</u>A Contact</b></label>:
       </td>
       <td>
-
         [% IF bug.check_can_change_field("qa_contact", 0, 1) %]
           [% IF bug.qa_contact != "" %]
            <div id="bz_qa_contact_edit_container" class="bz_default_hidden">
             <span>
               <span id="bz_qa_contact_edit_display">
-              [% INCLUDE user_identity user=> bug.qa_contact %]</span>
+              [% INCLUDE global/user.html.tmpl who = bug.qa_contact %]</span>
               (<a href="#" id="bz_qa_contact_edit_action">edit</a>)
             </span>
           </div>
@@ -593,7 +592,7 @@
             initDefaultCheckbox('qa_contact');
           </script>
         [% ELSE %]
-          [% INCLUDE user_identity user => bug.qa_contact %]
+          [% INCLUDE global/user.html.tmpl who = bug.qa_contact %]
         [% END %]
       </td>
     </tr>
@@ -813,7 +812,7 @@
       <b>Reported</b>:
     </td>
     <td>
-     [% bug.creation_ts FILTER time %] by [% INCLUDE user_identity user => bug.reporter %]
+     [% bug.creation_ts FILTER time %] by [% INCLUDE global/user.html.tmpl who = bug.reporter %]
     </td>
   </tr>
   
@@ -833,11 +832,10 @@
 [%# Block for CC LIST                                                        #%]
 [%############################################################################%]
 [% BLOCK section_cclist %]
-  [% IF user.id %]
     <tr>
-        <td class="field_label">
-          <label for="newcc" accesskey="a"><b>CC List</b>:</label>
-        </td>
+      <td class="field_label">
+        <label for="newcc" accesskey="a"><b>CC List</b>:</label>
+      </td>
       <td>
         [% IF user.id %]
           [% IF NOT bug.cc || NOT bug.cc.contains(user.login) %]
@@ -867,35 +865,35 @@
           [% END %]
         [% END %]
         <span id="cc_edit_area_showhide_container" class="bz_default_hidden">
-          (<a href="#" id="cc_edit_area_showhide">edit</a>)
+          (<a href="#" id="cc_edit_area_showhide">[% IF user.id %]edit[% ELSE %]show[% END %]</a>)
         </span>
         <div id="cc_edit_area">
-          <div>
+          <br>
+          [% IF user.id %]
             <div>
-              <label for="cc">
-                <b>Add</b>
-              </label>
+              <div><label for="cc"><b>Add</b></label></div>
+              [% INCLUDE global/userselect.html.tmpl
+                  id => "newcc"
+                  name => "newcc"
+                  size => 30
+                  multiple => 5
+                %]
             </div>
-            [% INCLUDE global/userselect.html.tmpl
-                id => "newcc"
-                name => "newcc"
-                size => 30
-                multiple => 5
-              %]
-          </div>
-        [% IF bug.cc %]
-          <select id="cc" name="cc" multiple="multiple" size="5">
-          [% FOREACH c = bug.cc %]
-            <option value="[% c FILTER html %]">[% c FILTER html %]</option>
           [% END %]
-          </select>
-          [% IF user.id %]
-            <br>
-            <input type="checkbox" id="removecc" name="removecc">
-            [%%]<label for="removecc">Remove selected CCs</label>
-            <br>
+          [% IF bug.cc %]
+            <select id="cc" name="cc" multiple="multiple" size="5">
+              [% FOREACH c = bug.cc %]
+                <option value="[% c FILTER email FILTER html %]">
+                  [% c FILTER email FILTER html %]</option>
+              [% END %]
+            </select>
+            [% IF user.id %]
+              <br>
+              <input type="checkbox" id="removecc" name="removecc">
+              [%%]<label for="removecc">Remove selected CCs</label>
+              <br>
+            [% END %]
           [% END %]
-        [% END %]
         </div>
         <script type="text/javascript">
           hideEditableField( 'cc_edit_area_showhide_container', 
@@ -906,7 +904,6 @@
         </script>
       </td>
     </tr>
-  [% END %]
 [% END %]
 
 [%############################################################################%]
@@ -1167,23 +1164,3 @@
   [% value = undef %]
   [% spellcheck = undef %]
 [% END %]
-
-[%############################################################################%]
-[%# Block for user identities. Wraps the information inside of an hCard.     #%]
-[%############################################################################%]
-
-[% BLOCK user_identity %]
-  <span class="vcard">
-    [% FILTER collapse %]
-      [% IF user.name %]
-        <a class="email" href="mailto:[% user.email FILTER html %]" 
-           title="[% user.email FILTER html %]"
-          ><span class="fn">[% user.name FILTER html %]</span
-        ></a>
-      [% ELSE %]
-        <a class="fn email" href="mailto:[% user.email FILTER html %]">
-          [% user.email FILTER html %]</a>
-      [% END %]
-    [% END %]</span>
-[% END %]
-
diff --git a/template/en/default/bug/show-multiple.html.tmpl b/template/en/default/bug/show-multiple.html.tmpl
index 173d98e92..f1a5cc466 100644
--- a/template/en/default/bug/show-multiple.html.tmpl
+++ b/template/en/default/bug/show-multiple.html.tmpl
@@ -336,12 +336,12 @@
       <th class="rightcell">[% field_descs.cc FILTER html %]:</th>
       <td>
         [% FOREACH c = bug.cc %]
-          [% c FILTER html %][% ", " IF not loop.last() %]
+          [% c FILTER email FILTER html %][% ", " IF not loop.last() %]
         [% END %]
     [% ELSIF name == "reporter" || name == "assigned_to" 
              || name == "qa_contact" %]
       <th class="rightcell">[% field_descs.${name} FILTER html %]:</th>
-      <td>[% bug.${name}.identity FILTER html %]</td>
+      <td>[% bug.${name}.identity FILTER email FILTER html %]</td>
     [% ELSIF name == "flags" %]
         <th class="rightcell">Flags:</th>
         <td>
diff --git a/template/en/default/bug/show.xml.tmpl b/template/en/default/bug/show.xml.tmpl
index 23874d989..f6f3617a0 100644
--- a/template/en/default/bug/show.xml.tmpl
+++ b/template/en/default/bug/show.xml.tmpl
@@ -25,9 +25,13 @@
 
 <bugzilla version="[% constants.BUGZILLA_VERSION %]"
           urlbase="[% urlbase FILTER xml %]"
+          [%# Note that the maintainer's email is not filtered, 
+            # intentionally. Even logged-out users should be able
+            # to see that, since it will be in error messages anyway. 
+          %]
           maintainer="[% Param('maintainer') FILTER xml %]"
 [% IF user.id %]
-          exporter="[% user.email FILTER xml %]"
+          exporter="[% user.email FILTER email FILTER xml %]"
 [% END %]
 >
 
@@ -58,9 +62,9 @@
           <flag name="[% type.name FILTER xml %]"
                 id="[% flag.id FILTER xml %]"
                 status="[% flag.status FILTER xml %]"
-                setter="[% flag.setter.login FILTER xml %]"
+                setter="[% flag.setter.login FILTER email FILTER xml %]"
           [% IF flag.requestee %]
-              requestee="[% flag.requestee.login FILTER xml %]"
+              requestee="[% flag.requestee.login FILTER email FILTER xml %]"
           [% END %]
           />
         [% END %]
@@ -69,12 +73,12 @@
         [% FOREACH c = bug.longdescs %]
           [% NEXT IF c.isprivate && !user.in_group(Param("insidergroup")) %]
           <long_desc isprivate="[% c.isprivate FILTER xml %]">
-            <who name="[% c.author.name FILTER xml %]">[% c.author.email FILTER xml %]</who>
+            <who name="[% c.author.name FILTER xml %]">[% c.author.email FILTER email FILTER xml %]</who>
             <bug_when>[% c.time FILTER time FILTER xml %]</bug_when>
             [% IF user.in_group(Param('timetrackinggroup')) && (c.work_time - 0 != 0) %]
               <work_time>[% PROCESS formattimeunit time_unit = c.work_time FILTER xml %]</work_time>
             [% END %]
-            <thetext>[% c.body FILTER xml %]</thetext>
+            <thetext>[% c.body FILTER email FILTER xml %]</thetext>
           </long_desc>
         [% END %]
       [% END %]
@@ -93,7 +97,7 @@
             <filename>[% a.filename FILTER xml %]</filename>
             <type>[% a.contenttype FILTER xml %]</type>
             <size>[% a.datasize FILTER xml %]</size>
-            <attacher>[% a.attacher.email FILTER xml %]</attacher>
+            <attacher>[% a.attacher.email FILTER email FILTER xml %]</attacher>
         [% IF displayfields.attachmentdata %]
             <data encoding="base64">[% a.data FILTER base64 %]</data>
         [% END %]        
@@ -102,9 +106,9 @@
               <flag name="[% flag.type.name FILTER xml %]"
                     id="[% flag.id FILTER xml %]"
                     status="[% flag.status FILTER xml %]"
-                    setter="[% flag.setter.email FILTER xml %]"
+                    setter="[% flag.setter.email FILTER email FILTER xml %]"
                     [% IF flag.status == "?" && flag.requestee %]
-                      requestee="[% flag.requestee.email FILTER xml %]"
+                      requestee="[% flag.requestee.email FILTER email FILTER xml %]"
                     [% END %]
                />
             [% END %]
@@ -129,10 +133,13 @@
     [% IF field == 'reporter' OR field == 'assigned_to' OR
           field == 'qa_contact' %]
       [% name = val.name %]
-      [% val = val.email %]
+      [% val = val.email FILTER email %]
+    [% ELSIF field == 'cc' %]
+        [% val = val FILTER email %]
     [% ELSIF field == 'creation_ts' OR field == 'delta_ts' %]
       [% val = val FILTER time %]
     [% END %]
-    <[% field %][% IF name != '' %] name="[% name FILTER xml %]"[% END -%]>[% val FILTER xml %]</[% field %]>
+    <[% field %][% IF name != '' %] name="[% name FILTER xml %]"[% END -%]>
+      [%- val FILTER xml %]</[% field %]>
   [% END %]
 [% END %]
diff --git a/template/en/default/bug/votes/list-for-bug.html.tmpl b/template/en/default/bug/votes/list-for-bug.html.tmpl
index b93d1f346..a599dc0fb 100644
--- a/template/en/default/bug/votes/list-for-bug.html.tmpl
+++ b/template/en/default/bug/votes/list-for-bug.html.tmpl
@@ -43,8 +43,9 @@
     [% total = total + voter.vote_count %]
     <tr>
       <td>
-        <a href="votes.cgi?action=show_user&amp;user=[% voter.login_name FILTER url_quote %]">
-          [% voter.login_name FILTER html %]
+          <a href="votes.cgi?action=show_user&amp;user_id=
+                  [%- voter.id FILTER url_quote %]">
+          [% voter.login_name FILTER email FILTER html %]
         </a>
       </td>
       <td align="right">