[inciarco]

Originally Posted by Markus2

I can't reproduce this. For example my registered test-user can not see the tickets from administrator.

Can't See Them LISTED, but try by Browsing the URL of the Ticket of other User (Private or Public), (very easy because the last Number in the Address is Secuencial), and You'll see that ANY User can Access ANY Other User's Tickets, and also if Options for Edit, Open, Close, Delete, Tickets are Enabled then ANY User can do that to ANY Other User's Tickets; the Options for Usergroups of Edit Tickets and Edit ANY Tickets, are the Same because in the Code there isn't any Usage of the Edit/Open/Close/Delete ANY Ticket but the Code is Currently Designed to use the Edit/Open/Close/Delete Tickets as Edit/Open/Close/Delete ANY Ticket.

If Users are not that Smart they won't be Curious to try and access any other User Ticket, but if they are Malicious (or Smart Enough) they'll Start Seeing Other Users Tickets, simply by Changing the Last Number on the Browser's Address to 1 (ticket 1), 2 (ticket 2), ... x (ticket x), so there is Corrently Not Privacy on the Tickets because the Code is Incomplete.

Review the Code of the File "helpcenter.php" and You'll see that I'm Right.

I Hope PaulSonny would Share with Us a Fixed and Complete Version of that php File that separates those Permissions.

My Best Regards.