Uploaded image for project: 'CiviCRM'
  1. CiviCRM
  2. CRM-15713

Access bypass in CiviCase

          Details

          • Type: Bug
          • Status: Done/Fixed
          • Priority: Critical
          • Resolution: Fixed/Completed
          • Affects Version/s: 4.2.0
          • Fix Version/s: 4.4.10, 4.5.5
          • Component/s: None
          • Security Level: Security - Published
          • Labels:
            None
          • Documentation Required?:
            None

            Description

            • Case detail report shows all cases to anyone with access to the report
            • Case summary report shows all cases to anyone with access to the report
            • CRM_Case_Page_AJAX::caseDetails displays case information to anyone with "access CiviCRM" permission
            • CRM_Case_Page_AJAX::deleteCaseRoles can be used by anyone with "access CiviCRM" permission
            • CRM_Case_Page_AJAX::addClient can be used by anyone with "access CiviCRM" permission
            • CRM_Case_Page_AJAX::processCaseTags can be used by anyone with "access CiviCRM" permission

              Attachments

                Activity

                  People

                  • Assignee:
                    colemanw Coleman Watts
                    Reporter:
                    colemanw Coleman Watts
                  • Votes:
                    0 Vote for this issue
                    Watchers:
                    2 Start watching this issue

                    Dates

                    • Created:
                      Updated:
                      Resolved: