MantisBT: master 4b436c4c

Diff Back to Repository
Author Committer Branch Timestamp Parent
vboctor vboctor master 2020-04-19 13:36 master a38bfd1d
Affected Issues  0026893: APIs expose private attachments to users who has access to issue but not private notes
Changeset

Fix attachments API access checks

  • Fix attachment access checks for private attachments. (REST and SOAP)
  • Include note attachments within notes (REST)

Fixes 0026893
mod - api/soap/mc_issue_api.php Diff File
mod - core/file_api.php Diff File