Merge branch 'master' into development

* master:
  Bumped version to 20250707.1
  Bug 2038147
  Bug 2042314 - [HackerOne] GitHub PR webhook can write attachments to non-visible BMO bugs r=sheehan
  Bug 2052188 - Move Close as Invalid button to the bottom action bar
  Bug 2052429 - Show: Open/Closed/All selects All incorrectly
  Bug 1619459 - Updated QA test to stop testing XMLRPC/JSONRPC and only test REST
  Bug 2043733 - Live Github Status for Pull Requests
  Bug 2036191 - Crash Signature Field Mismatch in Bugzilla REST API
  Bug 2049554 - Cloned security bugs should default to being secure even if they aren't in the default security group
  Bug 1355999 - Autocomplete on https://bugzilla.mozilla.org/form.web.bounty

Author: dklawren

Bugzilla.pm

@@ -13,7 +13,7 @@ use warnings;
 
 use Bugzilla::Logging;
 
-our $VERSION = '20260630.1';
+our $VERSION = '20260707.1';
 
 use Bugzilla::Auth;
 use Bugzilla::Auth::Persist::Cookie;

Bugzilla/API/V1/Github.pm

@@ -94,7 +94,7 @@ sub pull_request {
   # can see it (non-fatal).
   my ($bug_id) = $title =~ BUG_RE;
   my $bug = Bugzilla::Bug->new($bug_id);
-  if ($bug->{error}) {
+  if ($bug->{error} || !Bugzilla->user->can_see_bug($bug->id)) {
     $template->process('global/code-error.html.tmpl',
       {error => 'github_pr_bug_not_found'}, \$message)
       || die $template->error();

Bugzilla/Bug.pm

@@ -2717,9 +2717,17 @@ sub set_all {
 
   $self->_add_remove($params, 'see_also');
 
-  # And set custom fields.
+  # And set custom fields. Only fields enabled for the bug's current
+  # product/component are considered; product/component were already applied
+  # via SUPER::set_all above, so this reflects the post-move state. This is
+  # intentional (bug 2036191): a value submitted for a field not enabled on
+  # the target product/component is ignored rather than written, closing the
+  # glitch where e.g. cf_crash_signature could be stored on a product that
+  # doesn't expose it.
   my @custom_fields
-    = grep { $_->type != FIELD_TYPE_EXTENSION } Bugzilla->active_custom_fields;
+    = grep { $_->type != FIELD_TYPE_EXTENSION } Bugzilla->active_custom_fields(
+        {product => $self->product_obj, component => $self->component_obj}
+    );
   foreach my $field (@custom_fields) {
     my $fname = $field->name;
     if (exists $params->{$fname}) {
@@ -3054,16 +3062,33 @@ sub _set_product {
     # We copy this array because the original array is modified while we're
     # working, and that confuses "foreach".
     my @current_groups = @{$self->groups_in};
+    my $dropped_group  = 0;
     foreach my $group (@current_groups) {
       if (!$product->group_is_valid($group)) {
         $self->remove_group($group);
+        $dropped_group = 1;
       }
     }
 
     # Make sure the bug is in all the mandatory groups for the new product.
     foreach my $group (@{$product->groups_mandatory}) {
       $self->add_group($group);
     }
+
+    # If any of the bug's groups were dropped because they aren't valid in the
+    # new product, add the target product's default security group so the bug
+    # stays restricted to the best of our ability. This covers non-default
+    # security groups such as dom-core-security, not just the source product's
+    # own default (Bug 2028240, Bug 2049554, Bug 2038147). Runs for all usage
+    # modes; the browser path additionally pre-selects the group in the
+    # verify-new-product UI via _check_default_product_security_group() in the
+    # BMO extension.
+    my @pre_move_names = map { $_->name } @current_groups;
+    for my $sec_group (
+      _target_security_group_when_dropping($product, \@pre_move_names, $dropped_group))
+    {
+      $self->add_group($sec_group);
+    }
   }
   else {
     # If we didn't change the product, we just die if any of these are invalid.
@@ -4372,20 +4397,45 @@ sub in_group {
 }
 
 # Returns extra group names to add when cloning $self into $target_product.
-# If the bug is in its source product's default security group and the target
-# product has a different one, the target group name is returned so the clone
-# stays secure (Bug 2028240).
+# When cloning across products, any of the bug's groups that aren't valid in
+# the target product are silently dropped. If that would lose a group, we add
+# the target product's default security group so the clone stays restricted to
+# the best of our ability. This mirrors what happens when a bug is moved
+# between products (see Bugzilla::check_default_product_security_group, which
+# the verify-new-product template calls with the dropped groups), and covers
+# non-default security groups such as dom-core-security -- not just the source
+# product's own default (Bug 2028240, Bug 2049554).
 sub extra_security_groups_for_clone {
   my ($self, $target_product) = @_;
   return () if $self->product_id == $target_product->id;
+  return () unless @{$self->groups_in};
+
+  # If every group the bug is in carries over to the target product, then no
+  # restriction is lost and there is nothing to compensate for.
+  my $dropped = $self->get_invalid_groups(
+    {bug_ids => [$self->id], product => $target_product});
+
+  my @group_names = map { $_->name } @{$self->groups_in};
+  return _target_security_group_when_dropping($target_product, \@group_names,
+    scalar @$dropped);
+}
+
+# Returns the target product's default security group name to add when a bug is
+# moved or cloned into $target_product and at least one of its groups would be
+# dropped there ($any_dropped is true). Returns () when nothing is dropped, the
+# target has no default security group, or the bug is already in it.
+# $group_names is an arrayref of the bug's current group names (caller supplies
+# the snapshot it needs). This keeps a bug that was secured in *any* group --
+# not only the source product's own default security group -- restricted after
+# a product change (Bug 2028240, Bug 2049554, Bug 2038147).
+sub _target_security_group_when_dropping {
+  my ($target_product, $group_names, $any_dropped) = @_;
+  return () unless $any_dropped;
   return () unless $target_product->can('default_security_group');
 
-  my @clone_groups = map { $_->name } @{$self->groups_in};
-  my $source_sec = eval { $self->product_obj->default_security_group };
-  return () unless $source_sec && grep { $_ eq $source_sec } @clone_groups;
-
+  local $@;
   my $target_sec = eval { $target_product->default_security_group };
-  return () unless $target_sec && !grep { $_ eq $target_sec } @clone_groups;
+  return () unless $target_sec && !grep { $_ eq $target_sec } @$group_names;
 
   return ($target_sec);
 }

Bugzilla/Config/Github.pm

@@ -17,7 +17,8 @@ sub get_param_list {
     {name => 'github_pr_linking_enabled',  type => 'b', default => 0},
     {name => 'github_pr_signature_secret', type => 't', default => ''},
     {name => 'github_push_comment_enabled', type => 'b', default => 0},
-    {name => 'github_api_token',           type => 't', default => ''},
+    {name => 'github_pr_status_enabled',   type => 'b', default => 0},
+    {name => 'github_api_token',           type => 'p', default => ''},
   );
   return @param_list;
 }

Bugzilla/WebService/Bug.pm

@@ -1754,20 +1754,31 @@ sub _bug_to_hash {
   foreach my $field (@custom_fields) {
     my $name = $field->name;
     next if !filter_wants($params, $name, ['default', 'custom']);
-    if ($field->type == FIELD_TYPE_BUG_ID) {
-      $item{$name} = $self->type('int', $bug->$name);
-    }
-    elsif ($field->type == FIELD_TYPE_DATETIME || $field->type == FIELD_TYPE_DATE) {
-      my $value = $bug->$name;
-      $item{$name} = defined($value) ? $self->type('dateTime', $value) : undef;
-    }
-    elsif ($field->type == FIELD_TYPE_MULTI_SELECT) {
-      my @values = map { $self->type('string', $_) } @{$bug->$name};
-      $item{$name} = \@values;
-    }
-    else {
-      $item{$name} = $self->type('string', $bug->$name);
-    }
+    $item{$name} = $self->_format_cf_value($field, $bug->$name);
+  }
+
+  # Include stored values for CFs not enabled for this product/component,
+  # so callers aren't silently missing data when a bug retains a value after
+  # its product/component changed.  Multi-select CFs are excluded: they are
+  # not preloaded by DB_COLUMNS and each accessor fires a separate SELECT,
+  # making them too expensive to include for hidden fields across many bugs.
+  my %seen_cf = map { $_->name => 1 } @custom_fields;
+  my @hidden_cfs = grep {
+    !$seen_cf{$_->name}
+      && $_->type != FIELD_TYPE_EXTENSION
+      && $_->type != FIELD_TYPE_MULTI_SELECT
+  } Bugzilla->active_custom_fields({skip_extensions => 1});
+  foreach my $field (@hidden_cfs) {
+    my $name = $field->name;
+    next if !filter_wants($params, $name, ['default', 'custom']);
+    my $raw = $bug->$name;
+    next if !defined($raw) || $raw eq '';
+
+    # Single-select fields store the '---' sentinel when unset; treat it as
+    # empty so hidden fields left at their default aren't surfaced as noise.
+    next if $field->type == FIELD_TYPE_SINGLE_SELECT && $raw eq '---';
+
+    $item{$name} = $self->_format_cf_value($field, $raw);
   }
 
   # Timetracking fields are only sent if the user can see them.
@@ -1823,6 +1834,22 @@ sub _bug_to_hash {
   return \%item;
 }
 
+sub _format_cf_value {
+  my ($self, $field, $value) = @_;
+  if ($field->type == FIELD_TYPE_BUG_ID) {
+    return $self->type('int', $value);
+  }
+  elsif ($field->type == FIELD_TYPE_DATETIME || $field->type == FIELD_TYPE_DATE) {
+    return defined($value) ? $self->type('dateTime', $value) : undef;
+  }
+  elsif ($field->type == FIELD_TYPE_MULTI_SELECT) {
+    return [map { $self->type('string', $_) } @{$value}];
+  }
+  else {
+    return $self->type('string', $value);
+  }
+}
+
 sub _user_to_hash {
   my ($self, $user, $filters, $types, $prefix) = @_;
   my $item = filter $filters,

Bugzilla/WebService/Server/REST/Resources/User.pm

@@ -28,6 +28,8 @@ sub _rest_resources {
     {GET => {method => 'login'}},
     qr{^/logout$},
     {GET => {method => 'logout'}},
+    qr{^/user/offer_account_by_email$},
+    {POST => {method => 'offer_account_by_email'}},
     qr{^/user$},
     {
       GET  => {method => 'get'},

Bugzilla/WebService/User.pm

@@ -852,7 +852,13 @@ and real name.
 
 This is the recommended way to create a Bugzilla account.
 
-=item B<Param>
+=item B<REST>
+
+POST /user/offer_account_by_email
+
+The params to include in the POST body are the same as below.
+
+=item B<Params>
 
 =over
 

buglist.cgi

@@ -29,7 +29,7 @@ use Bugzilla::Status;
 use Bugzilla::Token;
 
 use Date::Parse;
-use List::Util qw(any);
+use List::Util qw(any all);
 use List::MoreUtils qw(uniq);
 
 
@@ -890,9 +890,21 @@ $vars->{'closedstates'} = [map { $_->name } closed_bug_statuses()];
 
 # Determine which status filter tab is active for the toggle UI.
 {
-  my @requested = $params->param('bug_status');
+  my @requested   = $params->param('bug_status');
+  my @resolution  = $params->param('resolution');
   if (!@requested || any { $_ eq '__all__' } @requested) {
-    $vars->{'status_filter'} = 'all';
+    # resolution=--- (unresolved) only matches open bugs; a resolution list
+    # with no "---" only matches closed bugs. Either way that's a more
+    # specific filter than "all", even though bug_status wasn't set.
+    if (@resolution && all { $_ eq '---' } @resolution) {
+      $vars->{'status_filter'} = 'open';
+    }
+    elsif (@resolution && !(any { $_ eq '---' } @resolution)) {
+      $vars->{'status_filter'} = 'closed';
+    }
+    else {
+      $vars->{'status_filter'} = 'all';
+    }
   }
   elsif (any { $_ eq '__open__' } @requested) {
     $vars->{'status_filter'} = 'open';

extensions/BMO/lib/Data.pm

@@ -155,6 +155,7 @@ tie(
     "Testing"                                       => [],
     "Thunderbird"                                   => [],
     "Toolkit"                                       => [],
+    "Web Compatibility"                             => [],
     "WebExtensions"                                 => [],
   },
   qr/^cf_due_date$/ => {

extensions/BMO/template/en/default/bug/create/create-client-bounty.html.tmpl

@@ -147,7 +147,7 @@ function validateAndSubmit() {
     A short description of the issue being reported.
   </div>
   <input
-  required type="text" name="short_desc" id="short_desc" size="80">
+  required type="text" name="short_desc" id="short_desc" size="80" autocomplete="off">
 </div>
 
 <div class="form_section">
@@ -166,7 +166,7 @@ function validateAndSubmit() {
     The full URL (hostname/subpage) where the issue exists (if the URL is especially long
     please just include it in the comments)
   </div>
-  <input type="text" name="bug_file_loc" id="bug_file_loc" size="80" placeholder="https://">
+  <input type="text" name="bug_file_loc" id="bug_file_loc" size="80" placeholder="https://" autocomplete="off">
 </div>
 
 <div class="form_section">