You're absolutely right, it's a mistake from my part to pick the wrong config setting in the fix for 0015258, I should indeed have used update_bug_status_threshold and not update_bug_threshold.

I'll do some testing to ensure doing this does not reintroduce the original security issue whereby a reporter could change an issue status to new (if update_bug_status_threshold = REPORTER in this case), or other regressions.

OK, so with this change a reporter can update the status to anything allowed by the workflow, and considering that it is obviously required for a reporter to be able to report issues (!), the only way to remove the possibility to change status back to NEW, is to uncheck it as available 'Next status'.

This is not necessary however if the issue is in RESOLVED or CLOSED status as the Change Status list and button will not be displayed in this case.

This does introduce potential inconsistencies, with default settings: a reporter can change an issue's status to ASSIGNED, RESOLVED or CLOSED, but since they are not able to assign an issue (update_bug_assign_threshold) the handler will not be set.

I guess that's OK since we should expect the admin to set its workflow properly (i.e. set minimum access level for ASSIGNED and above).