PM20172: restricted user can view any record via the browser bookmark

Rational ClearQuest Fix Pack 14 (7.1.2.14) for 7.1.2
Rational ClearQuest Fix Pack 15 (7.1.2.15) for 7.1.2
Rational ClearQuest Fix Pack 16 (7.1.2.16) for 7.1.2
Rational ClearQuest Fix Pack 17 (7.1.2.17) for 7.1.2
Rational ClearQuest Fix Pack 18 (7.1.2.18) for 7.1.2
Rational ClearQuest Fix Pack 19 (7.1.2.19) for 7.1.2

APAR status

• Closed as program error.

Error description

• ClearQuest Web 7.1.1 with sample database and Firefox and IE any
  version
  
  1.   Logon USING ADMIN run query make a note of some record numb
  ers (I chose record SAMPL00000025)
  1a. Log out once you have chosen your record number.
  
  2. Log in as a restricted user
  3. Create a new record and save (record created was number SAMPL
  00000049)
  4.Right click on newly crated record select 'Bookmark'
  5.Create Bookmark as instructed by message box and select save w
  hen 'NEW BOOKMARK'window appears.
  6.Close 'Bookmark' window ? log out completely out and close CQW
  EB.
  
  7. Copy the record url (SAMPL00000049  e.g http://localhost/cqwe
  b/#/7.1.1
  /SAMPL/RECORD/SAMPL00000049?noframes=true?format=HTML?recordType
  =Defect) from normal browser bookmark DO NOT select enter or go
  
  8. Change the number seen for the record in the address bar to t
  he record chosen in step 1a. eg http://localhost/cqweb/#/7.1.1
  /SAMPL/RECORD/SAMPL00000025?noframes=true?format=HTML?recordType
  =Defect.
  
  OR  just paste record choice at step 1a 'http://localhost/cqweb/
  #/7.1.1/SAMPL/RECORD/SAMPL00000025?noframes=true?format=HTML?rec
  ordType=Defect' in a new browser window or tab
  
  9. Record access to SAMPL00000025 gained via the browser.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  In the ClearQuest 7.1.x Web client, a restricted user can
  view any record via the browser bookmark.
  

Problem conclusion

• A fix is available in ClearQuest 7.1.1.4 and 7.1.2.1.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  CLEARQUEST WIN

• Fixed component ID

  5724G3600

Applicable component levels

• R711 PSN

     UP