[Bug 887337] [NEW] starting update manager from indicator-session doesn't ask for password

[Launchpad Bug Tracker]

*** This bug is a security vulnerability ***

You have been subscribed to a public security bug:

When starting update manager from the session indicator's Updates Available item, when the user clicks install, the updates do install without asking for a password. I'm not sure whether the bug is that Update-manager started from indicator-session does not ask for password or that updatemanager asks for password when started from anywhere else, but there is an inconsistency here.
As not every user does have apply updates rights, I guess the correct behavior would be to ask for the password all the time.

ProblemType: Bug
DistroRelease: Ubuntu 11.10
Package: indicator-session 0.3.7-0ubuntu1
ProcVersionSignature: Ubuntu 3.0.0-12.20-generic-pae 3.0.4
Uname: Linux 3.0.0-12-generic-pae i686
ApportVersion: 1.23-0ubuntu3
Architecture: i386
CheckboxSubmission: 358fa14de53c8e5a7761d072c2a2e99d
CheckboxSystem: 2a6f54df59af338184485e85cbcf0d32
Date: Mon Nov  7 23:29:13 2011
InstallationMedia: Ubuntu 11.10 "Oneiric Ocelot" - Alpha i386 (20110727)
ProcEnviron:
 PATH=(custom, no user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: indicator-session
UpgradeStatus: Upgraded to oneiric on 2011-10-26 (12 days ago)

** Affects: update-manager (Ubuntu)
     Importance: Low
         Status: Invalid


** Tags: apport-bug i386 oneiric running-unity
-- 
starting update manager from indicator-session doesn't ask for password
https://bugs.launchpad.net/bugs/887337
You received this bug notification because you are a member of Ubuntu Foundations Bugs, which is subscribed to update-manager in Ubuntu.