Security issue: public access - Githubissues

arkhitech / redmine_mentions

Allows users to mention team members in their notes/comments.

MIT License

95 stars 88 forks source link

Security issue: public access #59

Closed getit4free closed 7 years ago

getit4free commented 7 years ago

if Redmine is configured to allow access to specific projects publicly (i.e. "Requires authentication" is not active) then access to /mentions/ is allowed for everybody and shows mentions from all projects!

hishammalik commented 7 years ago

There is no /mentions/ route whatsoever in this plugin