Project

General

Profile

Actions
Copy link

Defect #25791

closed

Bypass Tracker role-based permissions when copying issues

Added by Shane Coronado over 7 years ago. Updated over 7 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Jean-Philippe Lang
Category:
Issues permissions
Target version:
3.3.4
Start date:
Due date:
% Done:

0%

Estimated time:
Resolution:
Fixed
Affected version:
3.3.2

Description

Not sure if intended: We use the permission settings for our roles. However, our Developer role is able to create an issue that the role does not have permission to create. This was done by Copying said issue and not changing the Tracker field. By leaving the Tracker field blank, the user is able to create an issue that bypasses the role's permissions.

Files

Download all files
create_tickets_by_copy.jpg (29.7 KB) create_tickets_by_copy.jpg Shane Coronado, 2017-05-08 21:28
create_tickets_by_copy2.jpg (24.6 KB) create_tickets_by_copy2.jpg Shane Coronado, 2017-05-08 21:28
create_tickets_by_copy3.jpg (20.2 KB) create_tickets_by_copy3.jpg Shane Coronado, 2017-05-08 21:29
create_tickets_by_copy4.jpg (30.4 KB) create_tickets_by_copy4.jpg Shane Coronado, 2017-05-08 21:29
Actions
Copy link

Also available in: Atom PDF