r=glob,justdave
a=justdave

Documentation patch: clean-up identation after commiting patch for bug 198020: Bugzilla Guide contains no admin docs for flags.

Documentation patch for bug 266461: Document minimum requirements for ft_min_word_len MySQL parameter; patch by Shane H. W. Travis <travis@sedsystems.ca> modified by me.

Fixing documentation build tree, broken by the check in of bug 198020; rename the name of the `flags` section so it doesn't collide with already existing section.

Patch for bug 262182: editing a buglist from a tabular report shouldn't go to a wrong page; patch by Gervase Markham <gerv@mozilla.org>; r=rsiklos, a=justdave.

Documentation patch for bug 198020: provide admin docs for flags; patch by Shane H. W. Travis <travis@sedsystems.ca>; r=myk.

Patch for bug 267774: Remove unused variable in process_bug.cgi; patch by Frédéric Buclin <LpSolit@netscape.net>; r=kiko, a=justdave.

Patch for bug 267543: Checksetup.pl should contain proper spacing in my$sth... statement; r=justdave, a=justdave.

Patch for bug 266955: Only display interdiff options if we have other_patches; patch by Christian Reis <kiko@async.com.br>; r=myk, a=myk.

Documentation patch for bug 257692: link directly to the final URL for the developer's guide; patch by Shane H. W. Travis <travis@sedsystems.ca>; r=vladd.

Documentation patch for bug 247441: rephrase section 3.9 regarding access control on secure bugs; patch by Shane H. W. Travis <travis@sedsystems.ca>; r=vladd.

Patch for bug 266142: Make bug listing display optimal for viewing; patch by Steve Wardell <okapi@codeboy.net>, r=kiko, a=myk.

Patch for bug 265679: requests error complaining about lack of group membership should not contain wrong spelled &bnsp; patch by Frédéric Buclin <LpSolit@netscape.net>; r=vladd, a=justdave.

Patch for bug 212017: Should be able to change a bug if it has a flag requested that is no longer requestable; patch by Frédéric Buclin <LpSolit@netscape.net>; r=myk, vladd, a=myk.

Patch for bug 251596: make show.html template use customized body attribute; patch by Marc Schumann <wurblzap@gmail.com>; r=kiko, a=justdave.

Patch for bug 258355: remove 1x1.gif and use CSS instead in order to create suitable spacing; patch by Frédéric Buclin <LpSolit@netscape.net>; r=kiko, a=justdave.

Patch for bug 265011: Add missing <td> and </td> tags in query.cgi; patch by Frédéric Buclin <LpSolit@netscape.net>; r=kiko, a=justdave.

[SECURITY] Bug 250605: Changes to the metadata (filename, description, mime type, review flags) on attachments which were flagged as private get displayed to users who are not members of the group allowed to see private attachments when receiving bug change notification mails.  This only affects sites that use the 'insidergroup' feature.
Patch by Joel Peshkin <bugreport@peshkin.net>
r=kiko,justdave, a=justdave

[SECURITY] Bug 253544: Changes to the metadata (filename, description, mime type, review flags) on attachments which were flagged as private get displayed to users who are not members of the group allowed to see private attachments when viewing the bug activity log.  This only affects sites that use the 'insidergroup' feature.
Patch by Joel Peshkin <bugreport@peshkin.net>
r=zach,justdave, a=justdave

[SECURITY] Bug 263780: Exporting a bug to XML exposes user comments and attachment summaries which are marked as private to users who are not members of the group allowed to see private comments and attachments.  XML export is not exposed in the user interface, but is available to anyone who knows the correct URL to invoke it.  This only affects sites that use the 'insidergroup' feature.
Patch by Joel Peshkin <bugreport@peshkin.net>
r=vladd,justdave, a=justdave

[SECURITY] Bug 252638: It is possible to send a carefully crafted HTTP POST message to process_bug.cgi which will remove keywords from a bug even if you don't have permissions to edit all bug fields (the "editbugs" permission).  Such changes are reported in "bug changed" email notifications, so they are easily detected and reversed if someone abuses it.
Patch by Myk Melez <myk@mozilla.org>
r=gerv, a=justdave

Bug 250897: Enforce a 10 minute waiting period between password reset attempts to prevent the user getting mailbombed if the form is submitted multiple times.
Patch by Joel Peshkin <bugreport@peshkin.net>
r=kiko, a=justdave

Patch by Tiago R. Mello <tiago@async.com.br>
r=kiko, a=justdave

Patch by Marc Schumann <wurblzap@gmail.com>
r=kiko, a=myk

Documentation patch for bug 143490: Update documentation regarding code changes needed when running Bugzilla under win32 (some are no longer required since checksetup.pl no longer calls unsupported functions when running on Windows); patch by GavinS <bugzilla@chimpychompy.org>, r=vladd.

Patch for bug 192218: Ability to use a hyphen as a way to filter specifically for requests with no requestee; patch by Frédéric Buclin <LpSolit@netscape.net>; r=myk, a=myk.

Patch for bug 252137: tabular reports shouldn't be broken if a row/col/tbl header begins with an underscore; patch by Rob Siklos <rsiklos@adexa.com>; r=gerv, a=justdave.

Bug 265731: multipart_start in the server-push handling code wasn't honoring the $cgi->charset setting.
r=myk, a=justdave

fix for bug 263250: adds a base tag to the simple buglist so it can be loaded in an iframe on a remote site and have the CSS still work

fix for bug 256208: makes checksetup.pl create CVS-ignored skins/custom/ and children; r=gerv, a=justdave

Fix for bug 265240: make collectstats generate valid RDF by not cutting off the opening RDF tag; r=kiko, a=myk