Bug 1097798: Do not display the resolution in the dependency tree for open bugs, nor the target milestone if usetargetmilestone is off
r=dkl a=glob

Bug 1001462: Bug.search causes error when using simple token auth and specifying 'token' instead of 'Bugzilla_token'
r=glob,a=glob

Bug 1082106: $dbh->bz_add_columns creates a foreign key constraint causing failure in checksetup.pl when it tries to re-add it later
r=glob,a=glob

r/a=glob

r=gerv a=glob

r=dkl a=sgreen

r=glob,a=glob

r=dkl a=glob

Bug 1082887: comments made when setting a flag from the attachment details page are not included in the "flag updated" email
r=dkl,a=glob

Bug 1009406 - A user with local editcomponents privs cannot update the inclusion and exclusion lists when the flagtype is already restricted to products the user cannot edit
r=dkl, a=simon

r=glob,a=glob

Bug 1064140: [SECURITY] Private comments can be shown to flagmail recipients who aren't in the insider group
r=glob,a=glob

r=dkl,a=sgreen

r=dkl,a=sgreen

r=LpSolit,a=sgreen

r=gerv, a=justdave

Bug 1061247 - Successfully using a password change token should invalidate all other password change tokens for that user
r=gerv a=glob

Bug 1070317 - Bugzilla::Flag's attribute modification_date is affected by the user's timezone and differs from the database copy after a call to $flag->update()
r=dkl, a=justdave

Bug 1069363: "show user list again" link does not include is_enabled for showing previous results list
r=glob,a=glob

r=LpSolit a=sgreen

r=glob,a=sgreen

r=sgreen a=glob

Bug 768892 - Specific Search without search words yields invalid_column_name message, complaining about sort order "relevance desc"
r=gerv, a=glob

Bug 1040728 - testserver.pl on Ubuntu 12.04 with Apache2 invalidly gives error 'Failed to find the GID for the 'httpd' process' due to truncated command name
r=gerv,a=sgreen

r=glob, a=sgreen

r=sgreen a=glob

Bug 1046145: It is no longer possible to cancel an email address change when this one has already been confirmed
r=dkl a=sgreen

Bug 1036213 - (CVE-2014-1546) add '/**/' before jsonrpc.cgi callback to avoid swf content type sniff vulnerability
r=glob,a=sgreen

r=glob

r=sgreen, a=justdave

Bug 653597 - Reports with "Real Name" fields use foo_real_name in the url parameters for linked queries
r=gerv, a=justdave

r=dkl,a=sgreen

re-encrypted and their password does not match the current complexity
rule
r=dkl, a=glob