Do not let users try to merge teams into people

[Damien Raude-Morvan]

Launchpad lets user attempt to merge teams into user user profiles. Only Lp registry admin can do this. The form should not imply users can do this, nor should it scare the member of the team.

ORIGINAL MESSAGE:

I'm member of Debian Java Team. We have received the following "merge request" on our public mailing list :
-------------------------
We received a request to merge the Launchpad account named
'Debian Java Maintainers (pkg-java-maintainers)' -- which have registered the email address
'<email address hidden>' -- into the account named 'tarcisio-sousa'.
-------------------------

I don't know how we can deal with this but it's clearly an abuse of merge account feature.

[Damien Raude-Morvan (drazzib)]

Confirmation mail can be found here :
http://lists.alioth.debian.org/pipermail/pkg-java-maintainers/2010-November/029738.html

[Gavin Panella (allenap)]

Damien, did you remove the contact email address from the pkg-java-maintainers team?

[Curtis Hovey (sinzui)]

I do not see a bug here.

User can, and do, request to merge accounts by misunder. He cannot do so unless he controls the email address. Users cannot merge team (), Lp registry admins can, so this merge cannot be performed by a user.

[Gavin Panella (allenap)]

Curtis, there might be a bug in that he was able to request a team merge at all, which made me concerned that he might be able to proceed with the merge (made easier because the token URL was mailed to a public list address).

[Damien Raude-Morvan (drazzib)]

Thanks Gavin, your explanation is much clearer than mine.

My issue is that many Debian team have public mailing-list so any one can request "merge" and gather token from list archive.
Maybe teams (at least *@lists.alioth.debian.org) can be protected ?

Regards,