View Issue Details

WikiRelated ChangesetsJump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0013736mantisbtsecuritypublic2012-01-07 16:212014-09-23 18:05
Reporterrombert Assigned Torombert  
PrioritynormalSeveritymajorReproducibilityalways
Status closedResolutionfixed 
Target Version1.2.9Fixed in Version1.2.9 
Summary0013736: mc_issue_get_id_from_summary incorrectly checks for permissions
Description

mc_issue_get_id_from_summary. It does not take into account whether the issue is private and as a result will always reveal whether or not a private issue with a specified summary exists -- even if the user does not have permission to know about private issues.

TagsNo tags attached.

Relationships

related to 0013656 closedrombert Reporters have read/write access to existing data of other users 
related to 0015721 closedgrangeway Functionality to consider porting to master-2.0.x 

Activities

grangeway

grangeway

2013-04-05 17:57

reporter   ~0036378

Marking as 'acknowledged' not resolved/closed to track that change gets ported to master-2.0.x branch

Related Changesets

MantisBT: master-1.2.x 35aed248

2012-03-03 09:38

rombert


Details Diff		 Correct access checks in mc_issue_get_id_from_summary

Fixes 0013736: mc_issue_get_id_from_summary incorrectly checks for
permissions		 Affected Issues
0013736
mod - api/soap/mc_issue_api.php Diff File

MantisBT: master 4dd69a55

2012-03-03 09:41

rombert


Details Diff		 Correct access checks in mc_issue_get_id_from_summary

Fixes 0013736: mc_issue_get_id_from_summary incorrectly checks for
permissions		 Affected Issues
0013736
mod - api/soap/mc_issue_api.php Diff File