0012361: Can see private bug in MyView / ViewIssues but then 'access denied' when I view it

Notes
(0026740) jreese (administrator) 2010-09-16 13:23	Can you confirm for me if this happens if you have the public project selected as your current project? Does it also happen if you have a parent project selected, or only for All Projects?

(0029154) toddpw (reporter) 2011-07-13 02:27	Found some time to look at this again and tried it on a fresh 1.2.5 install. The Access Denied still occurs if the steps to reproduce are followed. When the Developer user selects the public project as his current project, the submitted private bug correctly disappears from My View / View Issues. I created a 2nd public project and made it a parent of the original public project. The private bug only disappears when its project is selected; the parent project gives the same behavior as All Projects (can see bug but opening it gives an Access Denied response page).

(0029158) toddpw (reporter) 2011-07-13 05:35	Found the problem. Context diff attached. In core/filter_api.php:filter_get_bug_rows() there is a check for each project the user can see, to decide if he can see private issues, or only public issues. This check correctly gets the user's access level for each project but then tests it against the GLOBAL threshold for seeing private issues. The attached diff computes the threshold separately for each project and fixes the problem reported above.

(0029641) dhx (developer) 2011-09-05 08:39	Thanks Todd, another very good report and patch. I've committed it to the master-1.2.x and master branches ready for the next release. Notice how I'm going through every report you've created and resolving them quickly... because I know the bug report quality is extremely high :) Apologies for the amount of time it has taken to respond to your reports and commit patches.

(0036409) grangeway (developer) 2013-04-05 17:57	Marking as 'acknowledged' not resolved/closed to track that change gets ported to master-2.0.x branch

Related Changesets
MantisBT: master 94e68102 Timestamp: 2011-09-05 05:34:48 Author: toddpw [ Details ] [ Diff ]	Fix 0012361: Private bug visibility leak in my_view/view_all_bug_page In the My View / View Issues screens, private bugs in public projects (and probably private projects too) appear to ignore the private_bug_threshold value of their project unless you select it. When some projects have tighter security on viewing private bugs than others, this creates a situation where a user who should not be able to see a bug can still discover its existence in My View and View Issues. Viewing it fails with 'access denied', but if the summary had confidential information in it then the security leak has already happened. I don't consider giving All Projects the tighter security to be a usable workaround, because then you can't find bugs in the projects that use normal security for private bugs, until you select one of them, but then you can only see the subproject hierarchy you just went into. Steps to reproduce: ------ On a fresh 1.2.2 install try this: Create a public project. In the project, edit thresholds so that you need manager to view private bugs. Submit a private bug to that project. Login as a different user with global access of developer. View All Projects. You can see the bug in MyView / ViewIssues but then when you click on it you get an Access Denied screen. If you select the bug's project, then it correctly disappears. ------ Signed-off-by: David Hicks <d@hx.id.au>
	mod - core/filter_api.php	[ Diff ] [ File ]

MantisBT: master-1.2.x cb74408f Timestamp: 2011-09-05 05:34:48 Author: toddpw [ Details ] [ Diff ]	Fix 0012361: Private bug visibility leak in my_view/view_all_bug_page In the My View / View Issues screens, private bugs in public projects (and probably private projects too) appear to ignore the private_bug_threshold value of their project unless you select it. When some projects have tighter security on viewing private bugs than others, this creates a situation where a user who should not be able to see a bug can still discover its existence in My View and View Issues. Viewing it fails with 'access denied', but if the summary had confidential information in it then the security leak has already happened. I don't consider giving All Projects the tighter security to be a usable workaround, because then you can't find bugs in the projects that use normal security for private bugs, until you select one of them, but then you can only see the subproject hierarchy you just went into. Steps to reproduce: ------ On a fresh 1.2.2 install try this: Create a public project. In the project, edit thresholds so that you need manager to view private bugs. Submit a private bug to that project. Login as a different user with global access of developer. View All Projects. You can see the bug in MyView / ViewIssues but then when you click on it you get an Access Denied screen. If you select the bug's project, then it correctly disappears. ------ Signed-off-by: David Hicks <d@hx.id.au>
	mod - core/filter_api.php	[ Diff ] [ File ]

Issue History
Date Modified	Username	Field	Change
2010-09-16 09:37	toddpw	New Issue
2010-09-16 13:23	jreese	Note Added: 0026740
2010-09-16 13:23	jreese	Assigned To	=> jreese
2010-09-16 13:23	jreese	Status	new => feedback
2011-07-13 02:27	toddpw	Note Added: 0029154
2011-07-13 02:27	toddpw	Status	feedback => assigned
2011-07-13 05:26	toddpw	File Added: 0012361.patch.txt
2011-07-13 05:35	toddpw	Note Added: 0029158
2011-07-16 15:10	atrol	Tag Attached: patch
2011-09-05 08:33	dhx	Assigned To	jreese => dhx
2011-09-05 08:33	dhx	Target Version	=> 1.2.8
2011-09-05 08:37	toddpw	Changeset attached	=> MantisBT master 94e68102
2011-09-05 08:37	toddpw	Assigned To	dhx => toddpw
2011-09-05 08:37	toddpw	Status	assigned => resolved
2011-09-05 08:37	toddpw	Resolution	open => fixed
2011-09-05 08:37	toddpw	Fixed in Version	=> 1.3.x
2011-09-05 08:37	toddpw	Changeset attached	=> MantisBT master-1.2.x cb74408f
2011-09-05 08:39	dhx	Note Added: 0029641
2011-09-05 08:39	dhx	Assigned To	toddpw => dhx
2011-09-05 08:39	dhx	Fixed in Version	1.3.x => 1.2.8
2011-09-06 10:34	jreese	Status	resolved => closed
2013-04-05 17:57	grangeway	Status	closed => acknowledged
2013-04-05 17:57	grangeway	Note Added: 0036409
2013-04-05 18:13	grangeway	Relationship added	related to 0015721
2013-04-06 03:43	dregad	Status	acknowledged => closed
2013-04-06 07:23	grangeway	Status	closed => acknowledged
2013-04-06 09:22	dregad	Tag Attached: 2.0.x check
2013-04-06 09:23	dregad	Status	acknowledged => closed