May i add a note, also?

I fail to see where is the problem... can you expand your point please?

I have reporter access ("Logged in as: Sergiodf (Sergio Del Franco - reporter)"), not Updater.
So, in this page (view.php) there is no button for update the bug. It is Ok.
But I can update it by generating an URL by hand.

The advanced update page checks for access levels, but does not enforce them or give an 'access denied' message like the standard update page; This should be fixed.

However, a reporter will still not be allowed to actually update the bug if they lack the necessary permissions.

After further looking, it seems this is because of the due date feature, in attempts to allow the user to update the due date even without persmissions to update anything else.

In my opinion, this should not be allowed, as it could potentially be a security risk, for example, brute-force viewing of private issues because you have access to update due dates.

I think the best solution is to:

• revert the old-style behavior for the update pages (only those with bug_update_threshold allowed)
• either: follow the tagging behavior, where you can update it by itself witha special form
• or: remove the ability to have a separate due date threshold

I'm partial to the second option. Is there really anyone who would have permission to select when a bug is due that wouldn't already have permissions to update the bug in the first place?

I would go with the first option. However, we have to support the case where a user has access to update an issue but not to update the due date. I can see in some installations that users have access to update their issues but not the due date of such issues.

Fixed in SVN trunk r5464.