Security concern: Sent link can be used to post comments on ticket opener behalf.

fredastaire

Hi all,With the rapid development of osTicket I find it hard to keep up with all the new features so maybe this is really a feature and not a bug.But some users have reported the same issue and we are concern about it: whenever users open a ticket, they receive a 'New ticket alert' mail with a direct link to the new ticket in it. Sometimes they have to forward that mail to collegues so the others (there are many reasons for this: open discussion, announcement, etc...). Those other users who receive the mail can then click on the link and post a new comment in the ticket (without the need of logging in) on behalf of the opener!. When you enter into the ticket the name of the opener appears on top of the comment and there is no way to tell the difference between comments posted by the opener or by someone else.So you think this a bug or a feature (or a bug of a feature)?, can this behaviour be switched off somehow?.P.S.: I forgot to state that we first realized about this in version 1.9.4, then we upgraded to 1.9.5.1 and it still persists.Regards,Fred

ntozier

It's a feature. They (ticket openers) shouldn't forward the email with the url to others. My understanding is that the link should only work once (but I could be wrong). If they want other people to be able to take part in a conversation in the ticket system the opener should and them with the original message (or replying to a ticket email) and CCing the person(s). Also staff can add them as a collaborator.

fredastaire

Hi ntozier,Thanks for your reply.I reply inline:They (ticket openers) shouldn't forward the email with the url to

others. Yes, but how do users know this is so?, there is no warning to make people aware that they shouldn't share that link.My understanding is that the link should only work once (but I

could be wrong). I regret to say that you are actually wrong! the link works as many times as you care to click on it.If they want other people to be able to take part in a

conversation in the ticket system the opener should and them with the

original message (or replying to a ticket email) and CCing the

person(s). Also staff can add them as a collaborator.Yes, but usually the users want to have an off-the-record conversation about the matter, not on the ticket. Or sometimes they forward the mail as an announcement to the group of the new request that has been made.I'm sorry but I see little benefit in this feature compared to the trouble it can cause. IMHO this behaviour should be made optional (via a configurable setting). I think I'll open a bug report over this.Cheers!Fred

peter

@[deleted] is correct in that it's a feature, users don't have to remember the ticket number or password to check the status of a ticket. The auto-login link works as long as the ticket is still valid.That said, it's totally optional -- simply edit your email templates in Admin Panel > Emails > Templates and remove or change the links and you're done!

fredastaire

Hi Peter,Great! I had forgotten about editing email templates. Good tip!, thank you.But while playing with the templates, there is something else that it's not quite right:I changed the var %{recipient.ticket_link} --> )for %{ticket.client_link} And now when I receive the mail and visit the included link, instead of being taken to see the ticket and ticket log, I'm taken to a screen where am asked for a valid email and ticket number (the latter is automaticaly filled): blank And when I put my email and click the "Email Acess Link" button, It sends me the direct link, the one that I was trying to avoid in the first place. Is this the right behaviour?.Cheers!Fred.