[rt-users] RT 2.0.13 bug? Anyone can *update* a ticket

[Steven J. Sobol]

Hello,

I'm using 2.0.13. I have one of my queues gatewayed to an e-mail address.
I have group rights set as follows: Everyone - CreateTicket, Requestor -
CommentOnTIcket, ReplyToTicket, ShowTicket, Watch.

I created a ticket via e-mail and then sent and update in from an e-mail
address that belongs neither to the requestor nor any of the watchers. It
got posted. Should that be happening? (In my opinion, if you didn't 
request a ticket and you're not a watcher/adminCC/CC, you shouldn't be
able to reply to it.)

Thanks :)

-- 
Steve Sobol, CTO  JustThe.net LLC, Mentor On The Lake, OH  888.480.4NET
- I do my best work with one of my cockatiels sitting on each shoulder -
6/4/02:A USA TODAY poll found that 80% of Catholics advocated a zero-tolerance 
stance towards abusive priests. The fact that 20% didn't, scares me...