[rt-users] permissions loophole?

[Martin Schapendonk]

# > I have noticed one odd thing with the way it processes mail 
# (although it =
# > may be my setup but I can't see where), if there is a user on the =
# > system, e.g. autocreated by opening a ticket, they can reply to any =
# > other ticket by simply changing the number in the subject of 
# the message =
# > and this reply will be forwarded onto the ticket requestor.
# 
# I have same problem. We don't want RT to sent mail out of RT, if 
# the transaction 
# is originated via *Email*. 

I think you both need to check your permissions.
Grant ReplyToTicket to Requestor, not to Everyone.

Regards,

Martin