The reason is that Bug.pm shows these fields by default: if (Param('timetrackinggroup')) { push @fields, qw(estimated_time remaining_time actual_time deadline); } But show_bug.cgi incorrectly excludes them when the user is not in the timetracking group: unless (UserInGroup(Param("timetrackinggroup"))) { @fieldlist = grep($_ !~ /_time$/, @fieldlist); } The first 3 fields are excluded, but deadline doesn't match the regexp.

The fix is not too hard and would prevent confidential data from being displayed. Requesting blocking.

Deadline is new to Bugzilla 2.20, see bug 103636. Fixing this for 2.18 would be hard ;) Cancelling blocking2.18.6.

As bkor is working on it, there is a good chance to have it ready for our next set of releases.

Found no other unfiled code that leaked the timetracking fields (in any of the Bugzilla versions). Did wonder a bit about percentage_complete and show_bug.cgi, but that field seems to be buglist.cgi only.

Comment on attachment 237541 [details] [diff] [review] Patch v1 r=LpSolit

Comment on attachment 237613 [details] [diff] [review] Backport for 2.20 and 2.22 r=LpSolit

Deadline was first introduced in 2.19.2, so that's when this bug dates back to.

tip: Checking in show_bug.cgi; /cvsroot/mozilla/webtools/bugzilla/show_bug.cgi,v <-- show_bug.cgi new revision: 1.49; previous revision: 1.48 done 2.22: Checking in show_bug.cgi; /cvsroot/mozilla/webtools/bugzilla/show_bug.cgi,v <-- show_bug.cgi new revision: 1.38.2.1; previous revision: 1.38 done 2.20: Checking in show_bug.cgi; /cvsroot/mozilla/webtools/bugzilla/show_bug.cgi,v <-- show_bug.cgi new revision: 1.32.4.2; previous revision: 1.32.4.1 done

Security Advisory has been sent, so this bug is no longer private.