Bug #22

Assignee filter dropdown exposes member list to unauthorized users

Status:	Open
Priority:	High
Added by:	scot on April 30, '24
Assigned to:	Unassigned
Due date:
Reported for:	0.6.0

Steps to Reproduce

1. Browse to https://app.betahub.io/projects/<project id>/issues
2. Inspect the source of the 'Assignee' dropdown
3. View a complete list of the project members

Explanation

Even if you are not authorized to view the members of a project via the member list of a project, the assignee filter drop down leaks the member list.
It seems all assignees and their IDs are listed in the drop down. From there, a user can browse to https://app.betahub.io/profiles/<id> to gather more info about a given user.

Watchers

Watch