I have a
Bugzilla server and I found a security issue. If I make logout on web interface I still can read bugs by direct link. Enumerating bug ID in the URL I can read all bugs already exists.
I was unable to found how to restrict access
Bugzilla for unauthorized (not logged in) users?
I have a
closed as off-topic by bish, Kate Paulk♦, Niels van Reijmersdal, Rsf, Peter M. Dec 15 '15 at 15:46
- This question does not appear to be about software quality assurance or testing within the scope defined in the help center.
If you want to stop external access then one way is to set Apache Password Protected Directories with .htaccess File
This will mean any user accessing below a certain DIR level will require a password for access. Please note, this access is independent from the access granted by Bugzilla
A simple instruction guide is available here