View Issue Details

WikiRelated ChangesetsJump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0002360mantisbtsecuritypublic2002-08-20 02:352003-12-13 04:52
Reporterrafmet Assigned Tojfitzell  
PrioritynormalSeveritymajorReproducibilityalways
Status closedResolutionfixed 
Summary0002360: developer can delete bug even when g_allow_bug_delete_access_level is set to MANAGER
Description

I have set $g_allow_bug_delete_access_level = MANAGER
When I'm logged in as developer I don't see 'Delete Bug'
button but I can delete bug by writing in URL:
bug_delete_page.php?f_id=[BUG_ID]

TagsNo tags attached.

Activities

reporter

reporter

2002-08-20 08:53

reporter   ~0003132

test note
jfitzell

jfitzell

2002-08-21 16:35

reporter   ~0003138

Jeroen, I fixed this and committed the fix but I wanted to assign it to you in case you wanted to do a security announcement about it... not sure what the policy is about when that needs to be done, etc...

--Julian
jlatour

jlatour

2002-08-21 21:24

reporter   ~0003150

Grmbl. Another advisory.

OK, thanks.
vboctor

vboctor

2002-08-22 06:02

manager   ~0003156

Last edited: 2002-08-22 06:11

I would mark this as resolved, and add a bug into mantis-dev which requests an advisory for this defect number. From the changelog, this configuration option seems to be added in 0.17.2. Hence, I would say the affected versions are: 0.17.2, 0.17.3, 0.17.4, 0.17.4a.

edited on: 08-22 06:11
jfitzell

jfitzell

2002-08-22 17:26

reporter   ~0003160

As per victor's request, this has been marked resolved. An issue for an advisory has been filed as #2382.

Related Changesets

MantisBT: master d9debe5d

2002-08-21 19:33

Julian Fitzell


Details Diff		 fix bug 2360 (mantisbt.sourceforge.net/mantis/view_bug_advanced_page.php?f_id=0002360)

I realize this will be better fixed when we refactor stuff into API calls but I thought I'd fix it for n
ow.

git-svn-id: http://mantisbt.svn.sourceforge.net/svnroot/mantisbt/trunk@1285 <a class="text" href="/?p=mantisbt.git;a=object;h=f5dc347c">f5dc347c</a>-c33d-0410-90a0-b07cc1902cb9		 Affected Issues
0002360
mod - bug_delete_page.php Diff File
mod - bug_delete.php Diff File