Question

As a customer, when I go to the case status page that a FogBugz user sent me, I can see my email address. This page is publicly accessible; isn't this a security bug?

Example tickeurl: http://[something]/fogbugz/default.asp?3_ggkscjak

Answer 1

This is not a bug or a significant security risk. The query string portion of the ticketurl is composed of three parts:

X_yyyyzzzz

1. X: The case number. For someone to get your email address, they would need to know the case number or one of your emails to/from FogBugz.

2. yyyy: Four characters after the underscore are a password. They are required to be able to view the status page for the case.

3. zzzz: The next four characters are a password which allows access to the Your Cases list: all the other cases submitted from the same email address.

For someone to get your email address, they would need to know a case number of yours and pick the correct password of the 1679616 possibilities.