View Issue Details

IDProjectCategoryView StatusLast Update
0025935mantisbtattachmentspublic2019-12-09 04:32
Reportersandyj Assigned Tovboctor  
PrioritynormalSeverityminorReproducibilityhave not tried
Status closedResolutionfixed 
Product Version2.20.0 
Target Version2.23.0Fixed in Version2.23.0 
Summary0025935: Warning for users when making public notes with attachments private

Currently, there is no support for private attachments. Users are successfully blocked from adding attachments to private notes. However, if a user wishes to retrospectively make a public note with an attachment private, the note becomes private but the attachment remains public. This is particularly problematic as the attachment appears to the user to be private but is in fact not.

I understand that there are already issues 0022817 & 0009802 open to address support of private attachments but in the interim, there should be a warning to users that the attachment will become public since this has the potential to expose sensitive information.

Steps To Reproduce
  • create a public note with an attachment.
  • make note private
  • impersonate user without access to private notes
  • note is hidden but attachment is accessible.
TagsNo tags attached.


related to 0022817 closedvboctor "private bugnotes" as default setting prevents uploading further attachments 
related to 0009802 closedvboctor Support attachments associated with private notes 


Issue History

Date Modified Username Field Change
2019-07-18 19:08 sandyj New Issue
2019-07-21 09:59 atrol Relationship added related to 0022817
2019-07-21 09:59 atrol Relationship added related to 0009802
2019-07-22 01:32 vboctor Assigned To => vboctor
2019-07-22 01:32 vboctor Status new => assigned
2019-07-22 01:45 vboctor Note Added: 0062406
2019-08-25 16:31 vboctor Status assigned => resolved
2019-08-25 16:31 vboctor Resolution open => fixed
2019-08-25 16:31 vboctor Product Version => 2.20.0
2019-08-25 16:31 vboctor Fixed in Version => 2.23.0
2019-08-25 16:31 vboctor Target Version => 2.23.0
2019-12-09 04:32 vboctor Status resolved => closed