Modify ↓

Opened 14 years ago

Closed 13 years ago

#7114 closed defect (fixed)

Unprivileged users opening a sensitive ticket don’t know that they succeeded

Reported by: Anders Kaseorg Owned by: Daniel Kahn Gillmor
Priority: normal Component: SensitiveTicketsPlugin
Severity: normal Keywords: newticket success feedback
Cc: Trac Release: 0.11

Description

If a user without SENSITIVE_VIEW permissions opens a sensitive ticket, then they do not have permission to view the ticket they just opened, and they are mysteriously redirected back to the new ticket form with no error message, and no indication that the ticket was successfully opened (even though it was).

Attachments (2)

7114.patch​ (2.5 KB) - added by Daniel Kahn Gillmor 13 years ago.
patch that enables some options: allow_reporter, allow_cc (both of which default to false) and allow_owner (defaults to true)
7114.2.patch​ (4.3 KB) - added by Daniel Kahn Gillmor 13 years ago.
revised patch which also adds limit_sensitivity option to prevent people from setting sensitivity on tickets they won't have access to.

Download all attachments as: .zip

Change History (6)

comment:1 Changed 13 years ago by Daniel Kahn Gillmor

Yes, this is a concern. Perhaps the reporter should be allowed access as well as people with SENSITIVE_VIEW. Or maybe anyone in the Cc field as well?

Changed 13 years ago by Daniel Kahn Gillmor

Attachment: 7114.patch​ added

patch that enables some options: allow_reporter, allow_cc (both of which default to false) and allow_owner (defaults to true)

comment:2 Changed 13 years ago by Daniel Kahn Gillmor

(sorry for the duplicate copies)

Changed 13 years ago by Daniel Kahn Gillmor

Attachment: 7114.2.patch​ added

revised patch which also adds limit_sensitivity option to prevent people from setting sensitivity on tickets they won't have access to.

comment:3 Changed 13 years ago by Steffen Hoffmann

Keywords: newticket success feedback added
Owner: changed from obs to Daniel Kahn Gillmor

assign to current maintainer now

comment:4 Changed 13 years ago by Daniel Kahn Gillmor

Resolution: → fixed
Status: new → closed

This should be closed as of r11287

Modify Ticket

Change Properties
Set your email in Preferences
Action
as closed The owner will remain Daniel Kahn Gillmor.
The resolution will be deleted. Next status will be 'reopened'.

Add Comment

E-mail address and name can be saved in the Preferences.

Attachments ↑ Description ↑
 
Note: See TracTickets for help on using tickets.