View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0002294SOGoBackend Address Bookpublic2013-04-18 12:582013-06-19 19:09
ReporterThomasRZ Assigned Toludovic  
PrioritynormalSeveritymajorReproducibilityalways
Status closedResolutionfixed 
Product Version2.0.5 
Target Version2.0.6Fixed in Version2.0.6 
Summary0002294: It is possible to import LDIF-files into a read-only set address book
Description

To reproduce this Bug simply do the following:

  • Set the ACLs of an address book from user "A" to read-only (possible with "any authenticated user" or a specific user "B").
  • Log in to user "B" and subscribe to the address book of user "A".
  • Import any LDIF file into the subscribed address book using the import function.

It normally should not be possible to write into a folder with read-only permissions.

TagsNo tags attached.

Activities

ludovic

ludovic

2013-06-19 19:09

reporter   ~0005668

Fixed: https://github.com/inverse-inc/sogo/commit/871115e349dd71ac2801650ff98fc98a888dabd6

Good catch buddy!

Issue History

Date Modified Username Field Change
2013-04-18 12:58 ThomasRZ New Issue
2013-05-24 11:48 ludovic Target Version => 2.0.6
2013-05-24 11:48 ludovic Description Updated
2013-06-03 14:48 ludovic Status new => assigned
2013-06-03 14:48 ludovic Assigned To => ludovic
2013-06-19 19:09 ludovic Note Added: 0005668
2013-06-19 19:09 ludovic Status assigned => closed
2013-06-19 19:09 ludovic Resolution open => fixed
2013-06-19 19:09 ludovic Fixed in Version => 2.0.6