Question

We need to add attachments to a BugzScout submission, and we would like the ability to set other fields too, so we're apparently relegated to the XML API. Which would be fine except that it requires embedding a "token" into our application. At first I was so glad that we don't have to embed our password in the app, but still the "indefinite token hack" is not an acceptable solution because -due to fogbugz permissions as I understand them- I have to give that user (for the token) "modify" permission (which necessarily includes "read" permission) to a FogBugz project in order to be able to submit a case.

That means that anyone with that token (which is everyone now that it is embedded in an app) can use the API to basically read and edit everything in the fogbugz project. With that in mind, we might as well embed the username/password anyway.

So, the questions are:

Is there anyway to configure permissions for my "BugzScout" user to make him only able to submit cases?

Or is there any way to use the XML API anonymously to only be able to submit new BugzScout cases?

Or could you make it so that we can use the XML API with a community user (which does have the possibility of "submit only" permissions) for the XML API in this restricted "BugzScout submission" scenario?

Answer 1

I agree that things get tricky when you need the power of the XML API, but are trying to use it in a situation that BugzScout is better suited for (from a permissions/security perspective).

What about trying the following:

1. Have your app submit all the necessary details to a web server of your control
2. Have server-side code on that web server proxy the information into FogBugz via the XML API

While obviously not ideal, it would give you the full power of the XML API, but also protect the API token from being exposed to a wider audience.