RT/RTIR: Modifying private tickets via UUID spoofing about csp HOT 4 OPEN

@rommelfs thanks for this. We will investigate this further.

from csp.

This is correct, User should not edit UUID manually, We have to set the UUID input field to read only or hidden field.

from csp.

Great, that's really good to hear. While you're on it, please make sure it can not be modified through the command line interface RT client, the REST API or modified POST requests.
If you could think of other ways, feel free to add them to the list.

from csp.

Even better, let's hope that no CSP user ever gains access to their SQL. Or perhaps, having a mechanism that doesn't allow any modifications from other CSP nodes to private data / no way to take over tickets would be even more helpful.

from csp.