Closed
Bug 69913
Opened 25 years ago
Closed 25 years ago
Flaw in Bugzilla allows users to change any field in bug
Categories
(Bugzilla :: Bugzilla-General, defect)
Tracking
()
People
(Reporter: bugzilla, Assigned: justdave)
Details
Attachments
(1 file)
|
15.67 KB,
text/html
|
Details |
Apparently any user with the canedit permission can change any field of any bug
just by using a local copy of a bug to submit the changes. This means users
can open confidential bugs, among other things.
To try this, open the attachment, enter the bug number you want to modify, and
change the fields you want. When you're done, press Commit; you'll get a mid-
air collision, so bypass it and your changes are made. The attachment could be
extended to include the bits of the other groupsets.
|
Reporter | |
Comment 1•25 years ago
|
||
|
Assignee | |
Comment 2•25 years ago
|
||
*** This bug has been marked as a duplicate of 39524 ***
Status: NEW → RESOLVED
Closed: 25 years ago
Resolution: --- → DUPLICATE
|
|
Reporter | |
Comment 3•25 years ago
|
||
Yep. Talked to Jesse about it and forgot to dup. Thanks.
Status: RESOLVED → VERIFIED
|
|
Assignee | |
Comment 4•24 years ago
|
||
moving to Bugzilla product
reassign to default owner/qa for INVALID/WONTFIX/WORKSFORME/DUPLICATE
Assignee: tara → justdave
Component: Bugzilla → Bugzilla-General
Product: Webtools → Bugzilla
Version: other → unspecified
|
||
Updated•13 years ago
|
QA Contact: matty_is_a_geek → default-qa
You need to log in
before you can comment on or make changes to this bug.
Description
•