0009252: Numeric link to issues tells title and status even if logged in user is not authorized

ID	Project	Category	View Status	Date Submitted	Last Update
0009252	mantisbt	security	public	2008-06-11 08:49	2009-06-26 12:05

Reporter	his	Assigned To	grangeway
Priority	normal	Severity	minor	Reproducibility	always
Status	closed	Resolution	fixed
Product Version	1.0.0rc3

Summary	0009252: Numeric link to issues tells title and status even if logged in user is not authorized
Description	A link to another issue number tells the issue title and status even if the user is not authorized to view the issue itself.
Steps To Reproduce	1) Create a new issue. 2) Insert a 0000001 with an issue number you are not authorzed to view; will be converted to a link automatically. 3) Save. 4) View the created issue. The link's title tag tells the issues status and title.
Additional Information	Tested with a german localized mantis.
Tags	No tags attached.

his 2008-07-02 09:43 reporter ~0018279	0009321 (added as related) is not visible to "public" users.

grangeway 2009-04-14 20:21 reporter ~0021539	Hello, I believe this issue is fixed in later releases (for bugs) and in 1.2 git trunk (for bug notes) Paul