Opened 12 years ago
Closed 12 years ago
#269 closed setup (invalid)
Any user can subscribe by self on any ticket in any tracs via email2trac
Reported by: | slevin@… | Owned by: | bas |
---|---|---|---|
Priority: | minor | Milestone: | |
Component: | email2trac | Version: | 2.4.0 |
Keywords: | permissions subscribe | Cc: |
Description
If user know the project name, he is can change it in replay message to trac or he is can create a new e-mail to trac with and known Project_Name and after one space #Ticket_id in subject filed and send it. So trac subcribe that user after receive that message on ticket=#ID and Project =Project_Name from subject in the received e-mail without any checks of email authors permissions.
I guess enought to checking author of email (or senders e-mail address) with fileds author,CC (or any subcribers list) in exist ticket (equal ticket_id from subject in e-mail) and when users_name can't find in tickets subscribers of ticket - drop e-mail (or any other action)
Bas, can U make control of this check like variable in email2trac.conf ? - for example: check_subscribers_list = 0/1
Attachments (0)
Change History (3)
comment:1 Changed 12 years ago by bas
- Priority changed from critical to minor
- Status changed from new to assigned
- Type changed from enhancement to setup
comment:2 Changed 12 years ago by anonymous
Damn, no! I'm looks like a stupid now :) Thank you Bas! It's really what I want!
PS: Bas, can U give me a your ICQ or email for quick link? O'course if it possible.
comment:3 Changed 12 years ago by bas
- Resolution set to invalid
- Status changed from assigned to closed
no problem. I am glad it is an easy fix ;-). I rather keep all the info and problems about email2trac in the trac system. Then people can read about it and maybe have an solution. But if you have some sensitive information you can always contact me at basv@…. I is just as quick as an email to this system
Did you read:
I think the option update_restricted_to_participants is what you want