Person.canWrite(), Person.canAccess() should not only work for the current user
Bug #767293 reported by
Abel Deuring
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Launchpad itself |
Triaged
|
Low
|
Unassigned |
Bug Description
For two reasons, a user can call the methods Person.canWrite() and Person.canAccess() only for himself:
1. These methods use the functions canWrite(), canAccess() from zope.security.
2. Calling these methods for other persons than the current user might leak sensitve information. We should probably allow these methods only for LP admins, or perhaps for teams where the current user is a member.
Changed in launchpad: | |
importance: | Undecided → Low |
status: | New → Triaged |
To post a comment you must log in.