[rt-users] Other queues showing up in "RT at a Glance"

[Tim Bishop]

On Mon, 2005-03-28 at 11:49 -0500, Brelsfoard, Alex wrote:
> OK, so one of my co-workers just noticed that people are seeing
> tickets from queues they don't have access too being listed in the "10
> newest unowned tickets..." window.  But here's the kinda weird bit:
> there is nothing under the "Queue" column for the tickets in the
> queues these people don't have access to.  When I look (I have access
> to see all queues) I see all the queue names.  So, to recap, Everyone
> sees all the tickets listed in that window.  If you have access to a
> queue, you see its name listed, otherwise just blank space.  This is
> very dangerous, because anyone can click on any of those links to view
> the contents of those tickets,a nd they an even TAKE the ticket.

I have the same "problem", but I think I know why.

On my queue(s) I have permissions for "CommentOnTicket", "CreateTicket",
"ReplyToTicket", and "ShowTicket" assigned to Everyone. This was to
allow tickets to be created and commented/replied to using email. And I
think so that people could use the web interface to view their own
tickets.

I suspect you have something similar...

A fix? I'm not sure - remove the ShowTicket right and give it to the
Requestor instead?

Cheers,
Tim.

-- 
Tim Bishop
http://www.bishnet.net/tim/
PGP Key: 0x5AE7D984