I have a Bugzilla server and I found a security issue. If I make logout on web interface I still can read bugs by direct link. Enumerating bug ID in the URL I can read all bugs already exists. I was unable to found how to restrict access Bugzilla for unauthorized (not logged in) users?

  • 4
    I'm voting to close this question as off-topic because security issues from individual software should be adress to the respective developers not on this side as we do not maintaine this software – bish Dec 15 '15 at 11:43
  • This is a question about QA/Testing software and its configuration. I think its appropriate. – ECiurleo Dec 15 '15 at 13:23
  • Better audience to ask this question would be Bugzilla mailing list. Part of guidance we should provide is that there are many questions related to QA which are better asked elsewhere. – Peter M. - stands for Monica Dec 15 '15 at 15:48
  • Thanks, I understand that this question is also oriented to administrators, not only to QA. – Jury Dec 22 '15 at 14:43

If you want to stop external access then one way is to set Apache Password Protected Directories with .htaccess File

This will mean any user accessing below a certain DIR level will require a password for access. Please note, this access is independent from the access granted by Bugzilla

A simple instruction guide is available here

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.