Actions
Defect #42100
closed
If new user is not attached to any project, he can see all users via URL simply typing numbers https://redmine.org/users/50
Status:
Closed
Priority:
Normal
Assignee:
-
Category:
Permissions and roles
Target version:
-
Start date:
Due date:
% Done:
0%
Estimated time:
Resolution:
Duplicate
Affected version:
Description
If new user is not attached to any project, he can see all users via URL simply typing numbers after /users/{number}
for example: https://redmine.org/users/50
In order to prevent this, user must be attached to some project with some role, otherwise, he can see list of all users.
Related issues
Updated by Holger Just 10 months ago
- Is duplicate of Feature #38853: Changes user visibility from "all" to "member of visible projects" for new roles and existing builtin roles added
Updated by Holger Just 10 months ago
- Status changed from New to Closed
- Resolution set to Duplicate
You can set the user visibility for non-member users as well as Anonymous by editing the respective roles in Administration -> Roles and permissions.
The setting for both roles as well as the default setting for new roles will be updated to "member of visible projects" in Redmine 6.0. See #38853. On older versions, you can edit this manually as described above.
Actions