Tuleap Agile Dashboard Unauthorized Access Fix

From this webpage screenshot, we can extract the following key information about the vulnerability: 1. Vulnerability Description: - Request ID: #39728 - Issue Description: If a user does not have access to a specific tracker, that tracker should not be displayed on the dashboard. 2. Fix Description: - Implementation Notes: Testing PUT card for a read-only user seemed to fail, but users cannot access private projects, so it doesn’t match the "read-only user" in the test name. - Fix Implemented: Now, tracker access permissions are checked before card access permissions. If access is denied, a 404 is returned instead of a 403. 3. Code Changes: - Files Modified: Changes involve multiple files, including class files from the and plugins. - File List: - - - - - - - - - 4. Commit Information: - Committer: Nicolas Terray (nterray) - Commit Time: October 2, 2024, 12:17 - Author and Committer: Nicolas Terray (nterray) - Commit Time: October 3, 2024, 10:51 - Hash: e5ce8127976115dc0f126a11d6b5065b5db7eeec - Parent Commit: e09b93121d75a99962293507d81c307ff6bacef9 - Reference: git#tuleap/stable/e5ce8127976115dc0f126a11d6b5065b5db7eeec This information helps us understand the context of the vulnerability, the applied fix, and the specific details of the code changes.

Goal Reached Thanks to every supporter — we hit 100%!

Tuleap Agile Dashboard Unauthorized Access Fix