[rt-users] urgent: disable search for new watchers

[Kevin Falcone]

On Jun 18, 2009, at 10:28 AM, Violetta J. Wawryk wrote:

> we just found out that in the people section everyone who can login  
> can
> search for people. So a person who has the following rights:
>
> CreateTicket
> ReplyToTicket
> SeeQueue
> ShowTicket
>
> can go to the people section and do a search like:
>
> userid doesn't contain xyz

I suspect you also have granted ShowConfigTab, otherwise
these users wouldn't see the Configuration menu.

There have been numerous fixes to this in the 3.8 series
and 3.6.7 was recently released to fix a different permissions issue

-kevin

>
> he gets all the users of the RT. Since this is a security issue, is
> there anything that I can do to prevent these searches?
>
> It might be disabled in a newer version, if so which would that be?
>
> A quick search on the list didn't give me an answer, therefore I  
> have to
> ask this. Sorry if it's been on the list before.
>
> Quick help is really appreciated, thanks in advance!!!!
>
> Regards
> Violetta
>
> -- 
> ________________________________ creating IT solutions
> Violetta J. Wawryk               science + computing ag
> IT-Service                       Hagellocher Weg 73
> phone +49 7071 9457 282          72070 Tuebingen, Germany
> fax   +49 7071 9457 211          www.science-computing.de
> -- 
> Vorstand/Board of Management:
> Dr. Bernd Finkbeiner, Dr. Roland Niemeier,
> Dr. Arno Steitz, Dr. Ingrid Zech
> Vorsitzender des Aufsichtsrats/
> Chairman of the Supervisory Board:
> Michel Lepert
> Sitz/Registered Office: Tuebingen
> Registergericht/Registration Court: Stuttgart
> Registernummer/Commercial Register No.: HRB 382196
>
>
> _______________________________________________
> http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users
>
> Community help: http://wiki.bestpractical.com
> Commercial support: sales at bestpractical.com
>
>
> Discover RT's hidden secrets with RT Essentials from O'Reilly Media.
> Buy a copy at http://rtbook.bestpractical.com
>