> Has anyone noticed with RT 3.6.1 that an otherwise unpriviledged user > (one who belongs to a group that only has CreateTicket, ReplyTicket, and > SeeQueue applied and no other perms anywhere) can do a search for "%" > and view bunch of old, resolved tickets? I've also noticed that certain
Nope I get this when I tried from a low level user account. X RT Error Couldn't load ticket '%' We are using Postgres as our database. I tested some random ticket numbers last week when I set up this test user and they weren't able to get to other tickets. What I've done to lock my users down is setup on each Queue 'Everyone' has CommentOnTicket, CreateTicket, ReplyToTicket, SeeQueue Then on a Global basis I set up, Group Rites, Roles, Requestor to have 'ShowTicket'. If I didn't do this they couldn't see a list of their own tickets on the webpage. There are a lot of places permissions can hide with roles & user definited groups off the end of the page so it might be buried down there. - Scott _______________________________________________ http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users Community help: http://wiki.bestpractical.com Commercial support: [EMAIL PROTECTED] Discover RT's hidden secrets with RT Essentials from O'Reilly Media. Buy a copy at http://rtbook.bestpractical.com
