From 65055265c8a88e2664f566bbb6eb0563ccc788bb Mon Sep 17 00:00:00 2001
From: "bzrmirror%bugzilla.org"
 <bzrmirror%bugzilla.org@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Mon, 13 Apr 2015 21:00:48 +0000
Subject: [PATCH] Bug 1151290: It is possible to tell if someone made a private
 comment on a bug even if you are not an 'insider' r=dkl,a=glob

git-svn-id: svn://10.0.0.236/trunk@265931 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/webtools/bugzilla/.bzrrev            |  2 +-
 mozilla/webtools/bugzilla/.gitrev            |  2 +-
 mozilla/webtools/bugzilla/Bugzilla/Search.pm | 10 ++++++++--
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/mozilla/webtools/bugzilla/.bzrrev b/mozilla/webtools/bugzilla/.bzrrev
index bd7041c746c..9eddccf3466 100644
--- a/mozilla/webtools/bugzilla/.bzrrev
+++ b/mozilla/webtools/bugzilla/.bzrrev
@@ -1 +1 @@
-9383
\ No newline at end of file
+9384
\ No newline at end of file
diff --git a/mozilla/webtools/bugzilla/.gitrev b/mozilla/webtools/bugzilla/.gitrev
index 7753b36acef..1cfa2d9c448 100644
--- a/mozilla/webtools/bugzilla/.gitrev
+++ b/mozilla/webtools/bugzilla/.gitrev
@@ -1 +1 @@
-0bcbc0faba0a0ed80eab653d3a696764686d202c
\ No newline at end of file
+802a5cccd273b9c9bc25d3251452147cb84f5571
\ No newline at end of file
diff --git a/mozilla/webtools/bugzilla/Bugzilla/Search.pm b/mozilla/webtools/bugzilla/Bugzilla/Search.pm
index e06e706a722..5cf36a76108 100644
--- a/mozilla/webtools/bugzilla/Bugzilla/Search.pm
+++ b/mozilla/webtools/bugzilla/Bugzilla/Search.pm
@@ -2520,11 +2520,17 @@ sub _user_nonchanged {
 sub _long_desc_changedby {
     my ($self, $args) = @_;
     my ($chart_id, $joins, $value) = @$args{qw(chart_id joins value)};
-    
+
     my $table = "longdescs_$chart_id";
     push(@$joins, { table => 'longdescs', as => $table });
     my $user_id = $self->_get_user_id($value);
     $args->{term} = "$table.who = $user_id";
+
+    # If the user is not part of the insiders group, they cannot see
+    # private comments
+    if (!$self->_user->is_insider) {
+        $args->{term} .= " AND $table.isprivate = 0";
+    }
 }
 
 sub _long_desc_changedbefore_after {
@@ -2532,7 +2538,7 @@ sub _long_desc_changedbefore_after {
     my ($chart_id, $operator, $value, $joins) =
         @$args{qw(chart_id operator value joins)};
     my $dbh = Bugzilla->dbh;
-    
+
     my $sql_operator = ($operator =~ /before/) ? '<=' : '>=';
     my $table = "longdescs_$chart_id";
     my $sql_date = $dbh->quote(SqlifyDate($value));