: Ticket transaction querying in REST interface is not restrictive enough

RT Developers
1

Against 3.6.3 to file

/share/html/REST/1.0/Forms/ticket/history

This patch fixes the following issue:

rt show ticket/N/history/id/M

succeeds where transaction M has nothing to do with ticket N. Put
another way, transaction queries always succeed if the transation number
is valid.

PK

Philip Kime
NOPS Systems Architect
310 401 0407

history.patch (813 Bytes)

2

Philip Kime wrote:

Against 3.6.3 to file

/share/html/REST/1.0/Forms/ticket/history

This patch fixes the following issue:

rt show ticket/N/history/id/M

succeeds where transaction M has nothing to do with ticket N. Put
another way, transaction queries always succeed if the transation
number is valid.

Thanks. Applied