View Issue Details

IDProjectCategoryView StatusLast Update
0013871mantisbtadministrationpublic2012-02-09 06:13
ReporterJanHegewald Assigned To 
PrioritynormalSeverityminorReproducibilityalways
Status newResolutionopen 
Product Version1.2.8 
Summary0013871: manage_project_threshold was not working on a per-project base
Description

The configuration switch 'manage_project_threshold' was not working on a per-project base. This means, that if you configure 'manage_project_threshold' = 'MANAGER' in config_inc.php and 'manage_project_threshold' = 'ADMINISTRATOR' at configuration page for some projects, a user with access level 'MANAGER' also had access to manage the project.

Steps To Reproduce
  1. log into Mantis with administrator rights
  2. configure 'manage_project_threshold' = 'MANAGER' in config_inc.php
  3. create a new project and add a new user with access level 'MANAGER'
  4. configure 'manage_project_threshold' = 'ADMINISTRATOR' at configuration page for the newly created project.
  5. logout from Mantis an re-login with the user mentioned in step 2
  6. you can manage the project created in step 2, while you should not be able to
Additional Information

A fix for this is the following: remove the line

$t_manage_project_threshold = config_get( 'manage_project_threshold' );

from manage_proj_page.php (line 94 in my installation) and add the line

$t_manage_project_threshold = config_get( 'manage_project_threshold', null, auth_get_current_user_id(), $t_project_id );

just below (line 111 in my installation)

$t_project = array_shift( $t_projects );
$t_project_id = $t_project['id'];

With this change the project where 'manage_project_threshold' = 'ADMINISTRATOR' is configured is not shown for a user with access level 'MANAGER' on manage projects page.

TagsNo tags attached.

Activities

JanHegewald

JanHegewald

2012-02-09 04:48

reporter   ~0031206

Can anyone please change the title as there is a typo: it should read manage_project_threshold and not managa_project_threshold