Defect #35090

Permission check mismatches button semantics

Added by Felix Schäfer 25 days ago. Updated 25 days ago.

Status:NewStart date:
Priority:NormalDue date:
Assignee:-% Done:

0%

Category:UI
Target version:-
Resolution: Affected version:4.2.0

Description

In source:/tags/4.2.0/app/views/issues/index.html.erb#L16 the link goes to the issues tab of the project settings. The button is only shown if the user has the manage_categories permission but the permission required for this tab is edit_project source:/tags/4.2.0/app/helpers/projects_helper.rb#L28

Note that this is only a UI issue, the button might be shown to users that cannot see the tab that it links to or the button might not be shown to users that would be able to see the tab that it links too, but upon following the link the correct permission is checked. There also is no information disclosure associated with this issue.

History

#1 Updated by Holger Just 25 days ago

  • Description updated (diff)

Also available in: Atom PDF