Anonymous can import issue

[ghost]

Hi,

Thanks for your great plug-in! I want to report a bug: Though I have set permission for anonymous can do nothing, they still can import issues via Importer page - just come to link: http://my_server/importer?project_id=project_id and import as usual and it is still successful.

Regards,

[logical-and]

Yeah, this is really bug.

[ghost]

Hi,

I have tried to change some thing to fix the problem: Edit file '$REDMINE_HOME/vendor/plugins/redmine_importer/init.rb' --> permission :import, {:importer => [:index, :match, :result]} #add :match, :result

Edit file '$REDMINE_HOME/vendor/plugins/redmine_importer/app/controllers/importer_controller.rb' --> before_filter :find_project, :authorize #add :authorize

Regards,