1466625 - can see the activity of other bug hunter by modifying in link

Status: RESOLVED INVALID

(Bugzilla :: Bugzilla-General, defect)

Description

[cyborg]

Attachment: bugzilla.PNG

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0
Build ID: 20180430140610

Steps to reproduce:

step 1: login to bugzilla.mozilla.org
step 2: click on my activity
step 3: in the url bar in wgo section change my email to other bug hunter email and it give me access to see their reports and i can generate it.


Actual results:

i can access the result and can see the data and generate reports.


Expected results:

i can't see other data/reports. it can't be bypassed the mail id.

Comment 1

[Mark Côté [:mcote]]

You can also some someone's activity by entering their address into the "who" field at the top.

This is intended behaviour.  The activity of users on Bugzilla is public data, except where it involves confidential bugs, which are hidden from unauthorized users.