Bug 1433400 (CVE-2018-5123) Prevent cross-site image requests from leaking contents of certain fields due to regex search
r=jfearn,a=dylan

r/a=dkl

Revert "Bug 1073264 - allow attachment download to be offloaded to the webserver using X-SendFile or equivalent. r=gerv, a=glob." Morning brain thought this bug was approved for 5.0.

This reverts commit 55e8faee.

Bug 1073264 - allow attachment download to be offloaded to the webserver using X-SendFile or equivalent. r=gerv, a=glob.

r=gerv a=glob

Bug 1082887: comments made when setting a flag from the attachment details page are not included in the "flag updated" email
r=dkl,a=glob

r=dkl,a=sgreen

r=dkl a=sgreen

r=gerv a=justdave

r=dkl a=sgreen

Bug 811280: Adds a caching mechanism to Bugzilla::Object to avoid querying the database repeatedly for the same information
r=dkl,a=LpSolit

r=justdave a=LpSolit

r=wicked a=LpSolit

Bug 771107 - List of attachments in attachment details screen does not distinguish obsolete attachments
r=glob, a=LpSolit

r/a=LpSolit

r/a=LpSolit

a=LpSolit

Bug 680131: Replace the MPL 1.1 license by the MPL 2.0 one in all files, and add it to files which miss one
r=kiko r=mkanat r=mrbball a=LpSolit

r=glob a=LpSolit

Bug 684225: The removal of locally stored attachments should be done from Bugzilla::Attachment->remove_from_db
r/a=LpSolit

[r=LpSolit a=LpSolit]

r=LpSolit, a=LpSolit

Bug 637981: (CVE-2011-2379) [SECURITY] "Raw Unified" patch diffs can cause XSS on this domain in IE 6-8 and Safari
r/a=LpSolit

r/a=LpSolit

r=mkanat, a=mkanat

a=LpSolit

r=LpSolit, a=LpSolit

a=LpSolit

Bug 453425 - Send "X-Content-Type-Options: nosniff" header when displaying attachments so IE8 doesn't try to sniff the content type.
[r=LpSolit a=LpSolit]

r/a=mkanat

Bug 490930: Always store attachments locally if they are over X size (and below some threshold!), don't ever display "Big File" checkbox
r=mkanat a=LpSolit

VALIDATOR_DEPENDENCIES, so that they don't need custom code in set_all.

Bug 565879: Merge ThrowCodeError("action_unrecognized"), ThrowUserError("no_valid_action") and ThrowCodeError("unknown_action")
r=ghendricks a=LpSolit

a=LpSolit

[r=mkanat a=mkanat]

r=timello, a=mkanat

r=LpSolit, a=LpSolit

decide which charset to use
r=LpSolit, a=LpSolit

Bug 532518: Credentials are not checked correctly when viewing one attachment from another bug's alternate host - Patch by FrÃdÃric Buclin <LpSolit@gmail.com> r=mkanat a=LpSolit

Bug 162060: Remove the relationship between "votestoconfirm" and whether or not the UNCONFIRMED status is available, by adding a checkbox to enable the UNCONFIRMED status in editproducts.cgi.
Patch by Max Kanat-Alexander <mkanat@bugzilla.org> r=LpSolit, a=LpSolit