593817 - User can see all Test Runs and Cases not only those for which products, he has access

Status: UNCONFIRMED

(Testopia :: Security, enhancement)

Description

[Stephan Hector]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8 (.NET CLR 3.5.30729)
Build Identifier: 2.4.1

Suppose I have Product A, B and C and Group aa and bb in Bugzilla.

aa has access to Product A and B, but not c and is in Group testers.

When opening Testopia, aa see ALL Test Runs, whether assigned to Product A or B or C.

If clicking on a Product under Classifications, view is reduced to Test Runs to which access was granted per Bugzilla. But if you know the name of a Test Run of another Product, you can access it over the name.

I've read, that this is a "feature" in Testopia and that you have to grant access in Test Run, but this isn't a logical or intuitive way to get "security".

It would be much better, if Testopia would use Bugzilla access management at this point. So it's more a feature request, than a bug.

Reproducible: Always

Steps to Reproduce:
1. Login to Bugzilla
2. Go to Dashboard of Testopia
3. See ALL Test Runs
4. Click on a classification
5. See only Test Runs for products with granted access
6. Type in name of test run not to see and get access
Actual Results:  
I see more Test runs, that i was granted access to.

Expected Results:  
See only test Runs, that i was granted access to.

I use Bugzilla 3.6.2 with testopia 2.4.1 and germzilla-Addon, but behaviour is described as feature in help on page 28, but it's really a very very uncool feature that way.