Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Unprivileged user can detach private Issue from Changeset #356

Closed
dregad opened this issue Jan 18, 2021 · 0 comments
Closed

Unprivileged user can detach private Issue from Changeset #356

dregad opened this issue Jan 18, 2021 · 0 comments
Labels
bug core security
Milestone
2.4.1

Comments

@dregad
Copy link
Member

dregad commented Jan 18, 2021

A user with Update access level, can detach any Issue from a Changeset, even if they do not have access to it (i.e. private Issue), by calling the Source/detach page directly with the appropriate parameters.

Related to #344
@dregad dregad added this to the 2.4.1 milestone Jan 18, 2021
@dregad dregad closed this as completed in c10ef2a Jan 18, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug core security
Projects
None yet
Milestone
2.4.1
Development

No branches or pull requests
1 participant
@dregad