search

256MbTeam / Redmine-Scrumbler

Easy to use plugin for Redmine. It allows users to use the Scrum/Agile process in projects. Scrumbler have interactive dashboard with the ability to configure for each sprint. Plugin adds Scrum Points field in every issue in project. Scrumbler as possible using the standard redmine structure of projects.
GNU General Public License v2.0
112 stars 41 forks source link

Security : Scrumbler accessible from anonymous user #66

Closed letic closed 12 years ago

letic commented 12 years ago

Hey there,

While testing I found out that any user can access to Scrumbler if they know the URL despite the permissions set.

This is reproducible on the demo.

For example : http://demo.nishisha.net/projects/testdrive doesn't show the Scrumbler tab to anonymous user but you can access http://demo.nishisha.net/projects/testdrive/scrumbler

This wouldn't be too big an issue if all sprints and issues weren't visible.

I don't have the time to have a look right now but I'll try to investigate the issue.

Cheers LeTic

crazydan commented 12 years ago

I can confirm this issue with Redmine Redmine 1.3.0.stable.8442 and Scrumbler 1.5.0.

xeta commented 12 years ago

fixed with 1d0f520dca6855b7d22a5c0d8e4b8a60c7788c75