This is about https://fedorahosted.org/freemedia/ tickets permissions.
The tickets contain people's private data and should be available only to people who are in 'freemedia' group of FAS.
So TICKET_VIEW, TICKET_MODIFY, REPORT_VIEW, SEARCH_VIEW and other permissions which enables one to view private data should be granted only to 'freemedia' group members.
So far, this has been granted to anyone authenticated and caused some grievances.
completed. Only members of the freemedia group may now authenticate. No trac changes are required.
I am a member of FreeMedia group, I checked. But I can not login. :)
It keep on asking for authorization again and again. When I enter my info, it tries, reject and comes back to the authorization dialog.
try again, it should be working now. We had a minor configuration issue.
This isn't closed anyways, there's a loophole in the mechanism. We'll work on closing it up.
I think this is fixed?
Yes, it is working nicely for us.
However, I am not aware of what loophole jstanly talked about or whether it is fixed or not.
Closing this for now, Jon - feel free to reopen if you remember what that loophole was.
Login to comment on this ticket.