nilsteampassnet/TeamPass — Issue #42: mysql root user can grant access to any non-personal password to any user
Author: tpharryman
Created: 2012-02-14 00:42:26+00:00
State: open

By adding the user number to the restricted_to column of the teampass_items table, a mysql user with access would be able to grant access to any user to any password not in a personal folder (it doesn't seem to allow the personal item to be seen, regardless of the entry in this column).

Ideally, the only access for passwords would be by the party entering them (or their manager) to grant access, not a system user.