View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0006959 | mantisbt | security | public | 2006-04-19 18:06 | 2006-04-20 06:24 |
| Reporter | jens_heitmann | Assigned To | vboctor | ||
| Priority | normal | Severity | tweak | Reproducibility | always |
| Status | closed | Resolution | duplicate | ||
| Product Version | 1.0.2 | ||||
| Summary | 0006959: "Reporter" Filter shows up all reporters. | ||||
| Description | The reporter filter shows up every reporter registered in the bugtracker system. If a reporter has only access to a limited number of private projects/subprojects it will be best if only reporters visible that are working with the same project (also if "all projects" are selected). Any other reporter that is only assigned to other private projects should be hidden to such a reporter. In my opion this is a security issue, if you manage different indepent projects within one Mantis instance. Find my patch below. | ||||
| Additional Information | I've modified project_api.php (find it attached to this report) in the following way: function project_get_all_user_rows( $p_project_id = ALL_PROJECTS, $p_access_level = ANYBODY ) {
.... This works well in my configuration. I'm not sure yet, if the change interferes some other functionality. | ||||
| Tags | No tags attached. | ||||
| duplicate of | 0006960 | new | "Reporter" Filter shows up all reporters. |