Re: [mantisbt-help] 1.1.0a4 Security Issues

[Shawn H. <nya...@gm...>]

Thanks for the prompt reply!

The issue was indeed with the access levels, however, I was changing them in
the config_inc.php and even trying the config_defaults_inc.php to no avail.
I then remembered that the config options have been moved into the database
and I set the options there and voile' it works so thanks for pointing me in
the right direction.

What would be the best practice to ensure consistency in my configuration
going forward, i.e. some settings in the DB and some in the config_inc.php?
Furthermore, which settings take preference is the order as follows;
1.  config_inc.php
2.  database
3.  config_defaults_inc.php




On 8/29/07, Gianluca Sforna <gi...@gm...> wrote:
>
> On 8/29/07, Shawn Hill <nya...@gm...> wrote:
> > Hello,
> >
> > I have installed 1.1.0a4 and I have found that any user can can edit any
> > other users notes.  This is of quite concern to me.  How do I go about
> > trying to resolve this one?
>
> Reading the relevant code in bugnote_view_inc.php, the edit note
> button is supposed to be shown:
>
> 1. if the current user access level is above
> "manage_project_threshold" (default: MANAGER)
> 2. if the current user is the note author (but only if
> $g_bugnote_allow_user_edit_delete is ON)
> 3. if the current user access level is above
> "update_bugnote_threshold" (default: DEVELOPER)
>
> If you witness a behavior not consistent with this, you should open a
> report in http://www.mantisbt.org/bugs, along with any relevant
> information you may have (for instance, the value of the above
> configuration variables and the access level of the users)
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems?  Stop.
> Now Search log events and configuration files using AJAX and a browser.
> Download your FREE copy of Splunk now >>  http://get.splunk.com/
> _______________________________________________
> mantisbt-help mailing list
> man...@li...
> https://lists.sourceforge.net/lists/listinfo/mantisbt-help
>



-- 
nya...@gm...