Vote #70254
完了Not-public queries are not private
0%
説明
I'd like to have the opinion of some of you about the following thing :
- if you save a custom query on issues, and mark it as public, everyone who can view issues can see it in the sidebar, and it's... public
- if you don't mark it as public, it's not really private since everyone can access it knowing the URL (increment the ID is a simple way to do that..)
I could understand both position about this tiny defect :
- it may be useful for managers who don't want to display a lot of queries in the sidebar, but want to have some shortcuts for them or their project members
- it could be considered as a confidentiality break and be made strictly private to the user who created the custom query
Thanks for any though about this.
journals
Confidentiality is a more critical concern than UI.
UI issue should be resolved via css / improved user control hack.
--------------------------------------------------------------------------------
Etienne Massip wrote:
> Confidentiality is a more critical concern than UI.
Well, given that if you can run other's queries, you still won't be able to see tickets you're not supposed to see, there's little security concerns to be raised.
However, if that reveals the query title, this might be potentially an inconvenience (e.g. project manager using some strong language in the query title while he believes it is never going to be public ;)
Anyway, there should be a way to check if a private query is run by someone who's not supposed to run it and simply deny access.
My 2 cents.
--------------------------------------------------------------------------------
It's more like a principle, a private object should not be visible to someone else than its owner.
Alex Shulgin wrote:
> Anyway, there should be a way to check if a private query is run by someone who's not supposed to run it and simply deny access.
Very easy, indeed, the query belongs explicitly to the user =)
--------------------------------------------------------------------------------
Fixed in r6163.
--------------------------------------------------------------------------------
Merged in 1.2-stable.
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
related_issues
duplicates,Closed,8946,Permissions for saving queries