0003445: User can see all information from all projects

ID	Project	Category	View Status	Date Submitted	Last Update
0003445	mantisbt	security	public	2003-12-03 15:32	2004-02-06 16:15

Reporter	ronde	Assigned To	vboctor
Priority	urgent	Severity	major	Reproducibility	always
Status	closed	Resolution	fixed
Product Version	0.18.0rc1

Summary	0003445: User can see all information from all projects
Description	If a user who's not assigned to a project select "summary" and then "view list" he gets all bugs from all projects. Even it is a privat project...
Tags	No tags attached.
Attached Files	3445_fix_error_where_user_can_see_all_defects_without_access.diff (611 bytes) Index: print_all_bug_page.php =================================================================== RCS file: /cvsroot/mantisbt/mantisbt/print_all_bug_page.php,v retrieving revision 1.71 diff -u -r1.71 print_all_bug_page.php --- print_all_bug_page.php 11 Jan 2004 09:09:38 -0000 1.71 +++ print_all_bug_page.php 25 Jan 2004 10:25:09 -0000 @@ -114,7 +114,7 @@ $project_count = db_num_rows( $result2 ); if ( 0 == $project_count ) { - $t_where_clause = ' WHERE 1=1'; + $t_where_clause = ' WHERE 1=0'; } else { $t_where_clause = ' WHERE ('; for ( $i=0;$i<$project_count;$i++ ) { 3445_fix_error_where_user_can_see_all_defects_without_access.diff (611 bytes)

vboctor 2004-01-24 12:27 manager ~0004916 Last edited: 2004-01-24 12:29	In print_all_bug_page.php, do the following: if ( 0 == $project_count ) { $t_where_clause = ' WHERE 1=1'; // change to 1=0 } else { This bug should only occur when: This has 0 enabled-public-projects User has no access to any of the enabled-private-projects. The user can also get access by going directly to the print page from within the View Bugs page. edited on: 01-24-04 12:29

vboctor 2004-01-24 12:28 manager ~0004917	CVS is currently down, will attach a patch when it is up again.

vboctor 2004-01-25 11:41 manager ~0004921	Fixed in CVS and will be included in next release. Also patch attached.