summaryrefslogtreecommitdiffstats
path: root/template/en/default
diff options
context:
space:
mode:
authorSimon Green <sgreen@redhat.com>2014-10-06 16:42:40 +0200
committerDavid Lawrence <dkl@mozilla.com>2014-10-06 16:42:40 +0200
commit976dc12e4ed769bc02ffeb2be03bb1720e885135 (patch)
treead7644c6ef1a2b5bea253e007f7166cfb37bfd28 /template/en/default
parent6d6b39029b7d2c24b17496fcdf8abdd080b59b55 (diff)
downloadbugzilla-976dc12e4ed769bc02ffeb2be03bb1720e885135.tar.gz
bugzilla-976dc12e4ed769bc02ffeb2be03bb1720e885135.tar.xz
Bug 1064140: [SECURITY] Private comments can be shown to flagmail recipients who aren't in the insider group
r=glob,a=glob
Diffstat (limited to 'template/en/default')
-rw-r--r--template/en/default/request/email.txt.tmpl13
1 files changed, 8 insertions, 5 deletions
diff --git a/template/en/default/request/email.txt.tmpl b/template/en/default/request/email.txt.tmpl
index 65946a1e1..54bed2e25 100644
--- a/template/en/default/request/email.txt.tmpl
+++ b/template/en/default/request/email.txt.tmpl
@@ -80,11 +80,14 @@ Attachment [% attidsummary %]
[%- FILTER bullet = wrap(80) %]
-[% USE Bugzilla %]
-[%-# .defined is necessary to avoid a taint issue in Perl < 5.10.1, see bug 509794. %]
-[% IF Bugzilla.cgi.param("comment").defined && Bugzilla.cgi.param("comment").length > 0 %]
-------- Additional Comments from [% user.identity %]
-[%+ Bugzilla.cgi.param("comment") FILTER strip_control_chars %]
+[% FOREACH comment = new_comments %]
+
+[%- IF comment.count %]
+--- Comment #[% comment.count %] from [% comment.author.identity %] ---
+[% ELSE %]
+--- Description ---
+[% END %]
+[%+ comment.body_full({ is_bugmail => 1, wrap => 1 }) FILTER strip_control_chars %]
[% END %]
[%- END %]