[#JRA-4791] Cannot create direct links to CreateIssueDetails due to security violation.

JIRA

Cannot create direct links to CreateIssueDetails due to security violation.

Created: 05/Oct/04 09:18 PM Updated: 07/Dec/05 08:01 PM

Component/s:

Permissions Security

Affects Version/s:

3.0 Standard Beta

Fix Version/s:

3.5

Time Tracking:

Not Specified

Participants:	Anton Mazkovoi [Atlassian], Benjamin Naftzger [Atlassian], Jeff Turner [Atlassian] and Sam Chang [Atlassian]
Since last comment:	2 years, 43 weeks, 4 days ago
Resolution Date:	07/Dec/05 08:01 PM
Labels:

Description

« Hide

If a simple html link is created to post data to CreteIssueDetails action with a project that does not allow anonymous issue reporting and the user is not logged in, an error is occur.

The preferred behaviour would be to redirect the user to to a login page (only if anonymous reporting is not allowed and the user is not logged) and then back to the CreateIssueDetails with all the passed parameters.

All

Comments

Work Log

Change History

Sort Order:

[ Permlink | « Hide ]

Jeff Turner [Atlassian] added a comment - 30/Oct/05 10:17 PM

I don't think this was ever properly fixed as Ben envisaged - which requires saving the whole form data, redirecting to login.jsp, and then redirecting back to CreateIssueDetails to finally create the issue. In 3.4 we just get a different error (see ~~JRA-8337~~).

[ Permlink | « Hide ]

Anton Mazkovoi [Atlassian] added a comment - 07/Nov/05 08:45 PM

If the user does not have permission to create issues they should not be presented with the Issue Creation form. They should be redirected to the login screen. Upon login the user should be redirected back to teh issue creation form with all the info filled in.

Anton

[ Permlink | « Hide ]

Sam Chang [Atlassian] added a comment - 07/Dec/05 08:01 PM

Done to redirect the user to a login screen - and upon successful login, taken to the create issue screen with all field values entered.