View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0006719 | mantisbt | security | public | 2006-02-15 10:12 | 2025-10-20 09:22 |
| Reporter | langis | Assigned To | vboctor | ||
| Priority | normal | Severity | major | Reproducibility | always |
| Status | closed | Resolution | fixed | ||
| Product Version | 1.0.0rc1 | ||||
| Fixed in Version | 1.1.0a1 | ||||
| Summary | 0006719: Manager of a project can assign the Administrator role to a user. | ||||
| Description | A manager should not be able to assign a role higher than manager to a user on any of his projects. When a user is assigned the Administrator role on a project, he can delete and create users, he can delete and create custom fields, he can change the system configuration. This is a major flaw in the security of MANTIS. The simpler way to fix this is to remove the ability to pick administrator as a role from a manager. | ||||
| Tags | No tags attached. | ||||
|
Fixed in CVS. Will be included in Mantis 1.1.0. Index: manage_proj_edit_page.phpRCS file: /cvsroot/mantisbt/mantisbt/manage_proj_edit_page.php,v
-# if ( $t_elem[0] >= ADMINISTRATOR ) {
|
|