Tuleap Project Administrator Privilege Escalation to View Fields of Other Projects Fix

From this webpage screenshot, the following key vulnerability information can be obtained: 1. Vulnerability Description: - Title: fix: request #39736 Project administrator can see fields of another project - Description: Fixed the issue where a project administrator could view fields from another project. 2. Change Information: - Change-Id: Ibc5c4ef3f23d79c2eb2de5210b1212ac6f986719 - Committer: Kevin Traini (ktraini) - Commit Time: 2024-10-01 15:32 - Committer and Commit Time: Kevin Traini (ktraini) committed again on 2024-10-03 10:53. 3. Modified Files: - File List: - plugins/tracker/include/Tracker/Permission/SearchUserGroupsPermissionOnFields.php - plugins/tracker/include/Tracker/Permission/SearchUserGroupsPermissionOnTrackers.php - plugins/tracker/include/Tracker/Permission/TrackersPermissionsDao.php - plugins/tracker/include/Tracker/Permission/TrackersPermissionsRetriever.php - plugins/tracker/include/Tracker/Permission/UserGroupInProject.php - plugins/tracker/tests/integration/Permission/TrackersPermissionsDaoOnArtifactsTest.php - plugins/tracker/tests/integration/Permission/TrackersPermissionsDaoOnFieldsTest.php - plugins/tracker/tests/integration/Permission/TrackersPermissionsDaoOnTrackersTest.php - plugins/tracker/tests/unit/Stub/Tracker/Permission/SearchUserGroupsPermissionOnFieldsStub.php - plugins/tracker/tests/unit/Stub/Tracker/Permission/SearchUserGroupsPermissionOnTrackersStub.php This information indicates that the vulnerability allowing project administrators to view fields from another project has been fixed, achieved by modifying multiple files related to permission handling.

Goal Reached Thanks to every supporter — we hit 100%!

Tuleap Project Administrator Privilege Escalation to View Fields of Other Projects Fix