Modify

Opened 9 years ago

Closed 9 years ago

#269 closed setup (invalid)

Any user can subscribe by self on any ticket in any tracs via email2trac

Reported by: slevin@… Owned by: bas
Priority: minor Milestone:
Component: email2trac Version: 2.4.0
Keywords: permissions subscribe Cc:

Description

If user know the project name, he is can change it in replay message to trac or he is can create a new e-mail to trac with and known Project_Name and after one space #Ticket_id in subject filed and send it. So trac subcribe that user after receive that message on ticket=#ID and Project =Project_Name from subject in the received e-mail without any checks of email authors permissions.

I guess enought to checking author of email (or senders e-mail address) with fileds author,CC (or any subcribers list) in exist ticket (equal ticket_id from subject in e-mail) and when users_name can't find in tickets subscribers of ticket - drop e-mail (or any other action)

Bas, can U make control of this check like variable in email2trac.conf ? - for example: check_subscribers_list = 0/1

Attachments (0)

Change History (3)

comment:1 Changed 9 years ago by bas

  • Priority changed from critical to minor
  • Status changed from new to assigned
  • Type changed from enhancement to setup

Did you read:

I think the option update_restricted_to_participants is what you want

comment:2 Changed 9 years ago by anonymous

Damn, no! I'm looks like a stupid now :) Thank you Bas! It's really what I want!

PS: Bas, can U give me a your ICQ or email for quick link? O'course if it possible.

comment:3 Changed 9 years ago by bas

  • Resolution set to invalid
  • Status changed from assigned to closed

no problem. I am glad it is an easy fix ;-). I rather keep all the info and problems about email2trac in the trac system. Then people can read about it and maybe have an solution. But if you have some sensitive information you can always contact me at basv@…. I is just as quick as an email to this system

Add Comment

Modify Ticket

Change Properties
Action
as closed The owner will remain bas.
The resolution will be deleted. Next status will be 'reopened'.
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.