Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #47761 MyProjects widget should only let you massmail members when you are a member of a project
    Infos
    #47761
    Thomas Gerbet (tgerbet)
    2026-07-30 12:29
    2026-07-29 16:43
    49506
    Details
    MyProjects widget should only let you massmail members when you are a member of a project

    It makes no sense to let users massmail people when they are not even supposed to see the action in the widget.

    AI-Assisted: LLM assisted findings (Claude Opus-4.8/5 and Sonnet-5).
    Internal references: CLAUDE-SECURITY-20260723-154130 F3 and tuleap-deepsec-cross-tenant-id-98b98c9f03.

    Project admin
    Empty
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Thomas Gerbet (tgerbet)
    Closed
    2026-07-30
    Attachments
    Empty
    References
    Referenced by request #47761

    Artifact

    rel #47138 17.6

    Other

    gerrit #38483
    Display settings

    Follow-ups

    User avatar
    Thomas Gerbet (tgerbet)2026-07-29 16:57
    • Summary
      -MyProjects/ProjectContact should only let you massmail members/admins when you are a member of/can access the project 
      +MyProjects widget should only let you massmail members when you are a member of a project