Create & comment notes possible with access token without `write_notes` permission about openstreetmap-website

[tomhughes]

Thanks for ignoring the security policy and causing an unnecessary emergency.

[AntonKhorev]

It this thing visible to anyone?
https://github.com/openstreetmap/openstreetmap-website/security/advisories/GHSA-cp68-6cpj-gg2j

[westnordost]

Sorry, I didn't notice the "Report a security vulnerability" button in the "new issue" template list. Feel free to make this report invisible to non-contributors.

I have also not been sure if this is intended behavior or not, because the permission is translated to English as "Modify notes" (sounds like "Editing notes")

... though, reflecting, I don't remember editing notes to be possible ever.

[westnordost]

It this thing visible to anyone?
https://github.com/openstreetmap/openstreetmap-website/security/advisories/GHSA-cp68-6cpj-gg2j

Not to me.

[tomhughes]

There is no way that I know of to hide an issue.

[tomhughes]

That other report is visible to me but as far as I can recall I have never been altered to it's existence until now.

[westnordost]

Hm right, I thought there was such an option, but I can't find it now. But anyway, you could delete it, it is on the right panel, below "Pin issue" and "Transfer issue".