mantisbt/mantisbt — comment on commit 46ff26ec28a251817c7fff9992efcb3501477655
File:  line 0
By vboctor:

I haven't reviewed the code, but we should only pass user id to web service calls when there is a scenario to use the web service method and pass in a different id than the caller. Even if we allow that, we may have a config that only allows admins or managers to do such thing, so there may be some authentication / authorization involved.