Non-volunteers can modify the category of their own report

Last checked: July 16, 2024

The bug

Non-volunteers can modify the category of their own report, which can cause, in some cases, inaccurate categorization and can make it more difficult for developers who may use the category to assign a report to the proper person.

An example of this occurring can be found on my testing report here (marked as private as so it does not interfere with bug tracker operations); feel free to remove the category from this report if you'd like (I'm just using it for testing purposes).

How to Reproduce

I use Google Chrome as my browser and a MacBook Air as my computer. Reproduction steps may be slightly different in other browsers or computers. Also, I'm not sure if the Mojira interface is different for volunteers than it is for standard users, so I don't know if you'll be able to reproduce this.

1. Click Edit button on top left of a report created by you
2. Right click, then click Inspect
3. Press Shift+Command+C
4. Hover mouse over Mojang Priority, and see that you've selected 

   <div class="field-group">

5. Click on class above that, should be 

   <div class="field-group" style="display: none;">

6. Remove 

   style="display: none;"

    from the line to make the category field visible

7. Click the small arrow in that line of text to reveal contents of the class
8. In the following tag, remove disabled: 

   <select class="select cf-select clientreadonly" id="customfield_11901" multiple="multiple" name="customfield_11901" size="5" data-remove-null-options="true" data-submit-input-val="true" data-input-text="" disabled="">

9. Now, close the inspector and select a category, and click Update. Notice that the changes appear on the page.

Unlike users changing Mojang Priority, this is a permanent change, meaning that even by refreshing the page the changes will be retained.

This issue was first posted on Github, so there might be some things I forgot to change when copying and pasting.

 

This bug was previously tested using MC-195635. Now, MC-222695 is being used.