Bug 1009013 - Require a user to change their password if they log in and their current password does not meet the password complexity rules
r=glob, a=sgreen

r=dkl a=sgreen

r=dkl, a=sgreen

Bug 726696 - All authenticated WebServices methods should require username/pass, token or a valid API key for authentication
r=dkl, a=sgreen

r=glob,a=glob

r=glob, a=glob

r=glob, a=justdave

r=glob a=justdave

Bug 966277 - Bugzilla native REST API should default to application/json if no Accept header was set
r=dkl,a=justdave

r=sgreen,a=justdave

r=dkl, a=glob

Bug 931765 - When you enter your login or password wrong, the error message shown "The username or password you entered is not valid" should be edited to "The login or password you entered is not valid"
r=dkl,a=sgreen

r=glob,a=justdave

Bug 859118 - Bug.search called with no arguments returns all visible bugs, ignoring max_search_results and search_allow_no_criteria
r/a=LpSolit

r/a=LpSolit

r/a=LpSolit

r=dkl a=LpSolit

r/a=LpSolit

r=wicked a=LpSolit

r/a=LpSolit

Bug 680131: Replace the MPL 1.1 license by the MPL 2.0 one in all files, and add it to files which miss one
r=kiko r=mkanat r=mrbball a=LpSolit

Bug 711714: (CVE-2011-3667) [SECURITY] The User.offer_account_by_email WebService method lets you create new user accounts independently of the value of Bugzilla::Auth::Verify::*::user_can_create_account
r=glob a=LpSolit

r=mkanat a=LpSolit

r/a=mkanat

r=mkanat, a=mkanat

r/a=mkanat

for patches when content_type is missing in Bug.add_attachment in the
WebService
r=LpSolit, a=LpSolit

and Bugzilla::Bug. See https://bugzilla.mozilla.org/show_bug.cgi?id=617477#c2
for details.
r=LpSolit, a=LpSolit

regex used by _bz_callback in Bugzilla::WebService::Server::JSONRPC to
accept numbers other than 0 or 1.
r=LpSolit, a=mkanat

Bug 575947: Users with passwords length less than 6 characters can't login after migration from 3.4.x or older to 3.6 or newer
r/a=mkanat

r/a=mkanat

https://bugzilla.mozilla.org/show_bug.cgi?id=412074

(Bug.add_attachment)
r=timello, a=mkanat

https://bugzilla.mozilla.org/show_bug.cgi?id=415813

r=dkl, a=mkanat

r=dkl, a=mkanat

them
r=dkl, a=mkanat

provide login credentials on a LOGIN_REQUIRED page. (Before this, it was
attempting to display the HTML login page to JSON-RPC clients.)
r=dkl, a=mkanat

r/a=mkanat

Patch by Max Kanat-Alexander <mkanat@bugzilla.org> r=LpSolit, a=mkanat