View Issue Details

WikiRelated ChangesetsJump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0003120mantisbtbugtrackerpublic2003-04-09 19:422003-12-13 04:38
Reportered Assigned Tovboctor  
PrioritynormalSeveritymajorReproducibilityalways
Status closedResolutionfixed 
Product Version0.17.5 
Summary0003120: Missing "Assign To" field on "Report Bug" screen
Description

The default access level on my system is Reporter. For certain projects, some users might be promoted to Developer level.

But there is a bug in the "Report Bug" page where if a user's default access level is "Reporter", even though his/her project access level is "Developer", the "Assign To" field is NOT shown.

The "Assign To" field should be shown when the user is in a project which he/she has "Developer" access to.

Also, is there a flag to define the Assign To threshold?

TagsNo tags attached.

Activities

ed

ed

2003-04-09 19:53

reporter   ~0004157

Last edited: 2003-04-09 20:14

Conversely, if the user's default access level is "Updater", if his/her access for a project is demoted to "Reporter", he/she should NOT be able to see the Assign To field.

But the Assign To field is erroneously shown in this case. (Mantis 0.17.5)

This could present a security risk.

The page at fault is report_bug_advanced_page.php.

edited on: 04-09-03 20:14
ed

ed

2003-04-09 20:22

reporter   ~0004158

The page at fault is report_bug_advanced_page.php, line 222.

<?php # reporters should not be able to assign to develoeprs ?>
<?php if ( get_current_user_field( "access_level" ) > REPORTER ) { ?>

Is this checking the user's default access level, or the user's current project access level? We certainly want to check the latter.

Would this line fix it?
<? if ( access_level_check_greater_or_equal( DEVELOPER ) ) { ?>
vboctor

vboctor

2003-04-09 23:07

manager   ~0004159

As you mentioned above the check should be for the user's project specific access level.

Also the flag to configure the access level needed to handle bugs is $g_handle_bug_threshold.

<? if ( access_level_check_greater_or_equal( config_get( 'handle_bug_threshold' ) ) { ?>
tv

tv

2003-04-10 04:50

reporter   ~0004160

Can we not use two different phrases to mean the same thing?

ie. 'handle' and 'assign to'.

That's very confusing.

How about going with 'assign to' consistently in the app?
ed

ed

2003-04-10 19:34

reporter   ~0004165

Agreed with your comment. I logged a similar request a while ago in 0003077.
vboctor

vboctor

2003-04-24 06:01

manager   ~0004250

Fixed in CVS. Will be available in 0.18.0a5. While fixing this defect, I fixed some other access related issues. See ChangeLog for more details.

Related Changesets

MantisBT: master 685b65f9

2003-04-24 00:00

vboctor


Details Diff		 Fix 0003120: Missing "Assign To" field on "Report Bug" screen.
Fix: Sometimes non-admin users are denied access to projects that they have
access for. This cause the project to revert back "All Projects" whenever the
user tries to set it to one of those private projects.

M core/access_api.php
- (access_cache_matrix): This function was not implemented and was not used.
Hence, removed.
- (access_cache_matrix_user): Some of the cache indices were used as returned
from the query without being converted to ints, and hence, were not found
later. This was causing a bug where non-admin users were denied access from
private projects.
- (access_cache_matrix_project): same fix as in access_cache_matrix_user.
- (access_has_project_level):
- Removed the use of hard-coded ADMINISTRATOR access level. The
private_project_threshold is not used.
- The handling for the case where a user was not added to a private project,
but had an access level greater or equal to private_project_threshold was not
handled correctly.
- (access_get_local_level): Convert the project id to an int before using it to
index the cache array. This is because 0001 can not be used to index 1.

M manage_user_proj_add.php
- Changed the required access to manage_user_threshold rather than
private_project_threshold. The access right that is need is to be able to
manage the users for the project, rather than access private projects.

M bug_report_advanced_page.php
- When the assign-to field was hidden, two spacer were added before the summary
field.

M set_project.php
- Added support to switch the current project in report bug pages without
jumping to main page.

M config_defaults_inc.php
- Removed a comment that claimed that $g_cookie_domain is not used while it is.

M core/gpc_api.php
- (gpc_clear_cookie): Added support for $p_domain parameter to be consistent
with gpc_set_cookie().

git-svn-id: http://mantisbt.svn.sourceforge.net/svnroot/mantisbt/trunk@2165 <a class="text" href="/?p=mantisbt.git;a=object;h=f5dc347c">f5dc347c</a>-c33d-0410-90a0-b07cc1902cb9		 Affected Issues
0003120
mod - config_defaults_inc.php Diff File
mod - manage_user_proj_add.php Diff File
mod - core/gpc_api.php Diff File
mod - core/access_api.php Diff File
mod - set_project.php Diff File
mod - doc/ChangeLog Diff File
mod - bug_report_advanced_page.php Diff File