View Issue Details

WikiJump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0007771mantisbtsecuritypublic2007-02-20 10:352013-07-17 17:40
Reporterrwhitney Assigned Tograngeway  
PrioritynormalSeveritymajorReproducibilityalways
Status closedResolutionunable to reproduce 
Product Version1.0.6 
Summary0007771: Anonymous users of type 'viewer' can change the status of bugs
Description

Currently on our system the anonymous user (with an access level of 'viewer') can change the status of the bug. Please view the attached screen shot.

Due to not wanting to expose our system to people potentially messing with it I can send the url of our mantis install to whoever is working on the bug so they can see the issue for themselves.

Not sure what else to add at this moment.

Steps To Reproduce
  1. Login as Anonymous
  2. View a bug

EXPECTED: Unable to change status

ACTUAL: User has ability to change status

TagsNo tags attached.
Attached Files
Picture 5.png (23,270 bytes)   
Picture 5.png (23,270 bytes)   

Activities

deboutv

deboutv

2007-02-20 11:02

reporter   ~0014073

Your system is not correctly configured. Check the change_status_threshold, you probably set it to VIEWER instead of DEVELOPER.
rwhitney

rwhitney

2007-02-20 11:23

reporter   ~0014074

I could not find any setting in the config file called change_status_threshold. Where is this set? Is it named something else?

There is this setting:

status change thresholds

$g_update_bug_status_threshold = DEVELOPER;
vboctor

vboctor

2007-02-24 01:17

manager   ~0014092

Are you sure the anonymous user wasn't added to the users list associated with the project that the project belongs to?
rwhitney

rwhitney

2007-03-05 23:27

reporter   ~0014131

I checked. The anonymous user has been added to the project but is still set to 'viewer'. That still makes me think they shouldn't be able to change the status. Sorry about the delay, things have been pretty busy for me lately.
vboctor

vboctor

2007-05-22 11:56

manager   ~0014595

Some questions to help with analyzing the issue:

  • Do you have a specific project selected or All Projects?
  • Is the project a public or private one?
  • What is the default access level for the anonymous user?
  • Is the bug reported by or assigned to the anonymous user?
rwhitney

rwhitney

2007-05-23 14:37

reporter   ~0014613

  • This happens for any project
  • These are only public projects, the private projects are not showing up for the anonymous user
  • Default access level is 'viewer' (as I stated originally)
  • No, the anonymous user cannot report bugs.

You can see this for yourself, go to
http://avoir.uwc.ac.za/mantis/ and look at some bugs. You'll see that you are able to change the status on ANY bug you view.
vboctor

vboctor

2007-05-23 15:12

manager   ~0014614

I can see the problem on your bug tracker. Did you notice that it is not happening on this bug tracker? If you logout and login as anonymous and go to an issue, you won't see the change status.

It seems to be a corner case. I will look at the code and try to see if it can be obvious from there.
rwhitney

rwhitney

2007-05-23 15:19

reporter   ~0014616

Ahhh, I see that.

So a couple things,

  1. I believe the version we're running is an older version. - Could that be it?
  2. Maybe an odd configuration setting? Should we compare?
vboctor

vboctor

2007-05-23 15:55

manager   ~0014617

It might be a good idea to attach your configuration file here or add it as a note. This is after removing any sensitive information in there.
rwhitney

rwhitney

2007-05-24 16:03

reporter   ~0014631

Ah'right, uploaded with any sensitive information removed.
grangeway

grangeway

2009-04-15 06:06

reporter   ~0021548

Thank you for taking the time to report a problem with mantis.

Since this problem report was originally made, a number of releases have occured. Additionally no recent feedback has been received on this issue.
It appears that this issue has either been fixed, or may not be a relevant report for the current release.

Unfortunately you are not using the latest version and the problem might already be fixed. Please download the latest release from http://www.mantisbt.org/download.php

If you are able to reproduce this bug in the current release, or have some more information on how this feature could be improved in the current release. Please either change the mantis version on this bug report
to the version you tested and change the status back to "Open", or open a new issue report with more information.

Again, thank you for your continued support and report.