<html><body><div style="color:#000; background-color:#fff; font-family:arial, helvetica, sans-serif;font-size:10pt"><div><span>Sounds like that's where I need to look then. It's an obvious place to look but sometimes one stares at a problem for so long that the obvious goes unnoticed!</span></div><div> </div><div>Thanks again,</div><div>---<br>Steven<br></div><div><br></div><br> <div style="font-family: arial, helvetica, sans-serif; font-size: 10pt; "> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt; "> <div dir="ltr"> <font size="2" face="Arial"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Marc Schumann <wurblzap@gmail.com><br> <b><span style="font-weight: bold;">To:</span></b> Steven Tierney <steven_tierney@yahoo.co.uk> <br><b><span style="font-weight: bold;">Cc:</span></b> "developers@bugzilla.org" <developers@bugzilla.org> <br> <b><span style="font-weight:
bold;">Sent:</span></b> Wednesday, 6 June 2012, 11:59<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: Please advise on security<br> </font> </div> <br><meta http-equiv="x-dns-prefetch-control" content="off"><div id="yiv1035346627">Steven,<br><br>unless you use ENV authentication (which you probably don't), Bugzilla uses cookies to identify the logged in user. I believe Javascript sends these unless you did something so that it doesn't, so you should be fine...<br>
Maybe you can take a look at what YAHOO.bugzilla.userAutocomplete does (in js/field.js), calling User.get (in Bugzilla/WebService/User.pm). User.get calls can_see_user, referencing the logged in user, and it works. Maybe you can use this as a template for your web service call.<br>
<br> Best<br> Marc<br>
</div><meta http-equiv="x-dns-prefetch-control" content="on"><br><br> </div> </div> </div></body></html>