Bug 1044563: The API key also works with XML-RPC and JSON-RPC, despite the documentation mentions REST only
r=sgreen,a=sgreen

r/a=sgreen

Bug 726696 - All authenticated WebServices methods should require username/pass, token or a valid API key for authentication
r=dkl, a=sgreen

Bug 1036213 - (CVE-2014-1546) add '/**/' before jsonrpc.cgi callback to avoid swf content type sniff vulnerability
r=glob,a=sgreen

- Fixed typo in editusers group name and used $user->can_bless.

Bug 950363 - The description of the 'smtpserver' parameter should specify that it accepts a port number
r=dkl,a=glob

r/a=glob

r=dylan, a=glob

r=glob,a=glob

r=dylan,a=glob

r=glob,a=glob

Bug 248994 - Edit user page description for inherited privs should use all instead of any for lists. r=gerv, a=sgreen.

Bug 1032323: canonicalise_query() should omit parameters with empty values so generated URLs are shorter
r=glob,a=sgreen

r=glob,a=sgreen

r=gerv, a=sgreen

r=sgreen,a=sgreen

Bug 1033445 - Certain webservice methods such as Bug.get and Bug.attachments should not use shadow db if user is logged in
r=sgreen,a=glob

r=sgreen,a=sgreen

r=glob, a=glob

r=glob, a=glob

r=gerv, a=glob

r=glob, a=glob

r=glob, a=glob

r=gkl, a=glob

Bug 1015226: When using field-label.html.tmpl there is not a way to underline the access key letter in the field description
r=glob,a=glob

r=glob, a=glob

Bug 1026726: filter_wants should be updated to allow exclude_fields higher precedence over include_fields=_all
r=glob,a=glob

r=glob,a=sgreen

r=glob,a=glob

r=sgreen, a=justdave

Bug 653597 - Reports with "Real Name" fields use foo_real_name in the url parameters for linked queries
r=gerv, a=justdave

r=gerv, a=glob

r=gerv,a=sgreen

r=gerv, a=sgreen

r=dkl, a=glob

r/a=glob