0021894: Handlers(Assignees) are visible when editing an issue even if they are not visible when viewing it

ID	Project	Category	View Status	Date Submitted	Last Update
0021894	mantisbt	security	public	2016-11-09 11:20	2016-11-27 00:45

Reporter	mcmo	Assigned To	atrol
Priority	normal	Severity	major	Reproducibility	always
Status	closed	Resolution	fixed
Product Version	1.3.3
Target Version	1.3.4	Fixed in Version	1.3.4

Summary	0021894: Handlers(Assignees) are visible when editing an issue even if they are not visible when viewing it
Description	if the view_handler_threshold configuration value is set to hide the handlers to reporters, the handlers are visible when the reporters edit an issue.
Steps To Reproduce	0- set update_bug_threshold to reporter 1- set view_handler_threshold to a value above reporter 2- create an issue with the reporter 3- assign the issue as a manager 4- view the issue as the reporter: the handler is hidden 5- edit the issue as the reporter: the handler is visible [EDIT dregad] added step 0 per atrol's note 0021894:0054549
Tags	No tags attached.
Attached Files	Editing Issue - Handler visible.png (22,626 bytes) Editing Issue - Handler visible.png (22,626 bytes) View Issue - Handler not visible.png (42,016 bytes) View Issue - Handler not visible.png (42,016 bytes)

atrol 2016-11-20 07:52 developer ~0054549 Last edited: 2016-11-20 08:00	Missing one step in "Steps To Reproduce" 0- set update_bug_threshold to reporter Also reproducible in 1.3.x Missing check for view_handler_threshold in bug_update_page.php

atrol 2016-11-24 06:14 developer ~0054573	PR https://github.com/mantisbt/mantisbt/pull/957

mcmo 2016-11-25 03:00 reporter ~0054584	Hi will that be fixed in version 2.0.0 as well? thanks

dregad 2016-11-25 03:01 developer ~0054585	In principle, all patches applied in 1.3 branch are merged in master branch as well, so yes.

MantisBT: master-1.3.x c8c4aa25 2016-11-24 01:09 atrol Details Diff	Check access rights to view handlers on bug update page Fixes 0021894		Affected Issues 0021894
	mod - bug_update_page.php		Diff File