Bug 415822

Summary: Discover Software Manager allows package updates without prompt for password authentication
Product: [Applications] Discover Reporter: LeeP
Component: discoverAssignee: Dan Leinir Turthra Jensen <leinir>
Status: RESOLVED DOWNSTREAM    
Severity: critical CC: aleixpol, nate
Priority: NOR    
Version First Reported In: 5.12.8   
Target Milestone: ---   
Platform: Kubuntu   
OS: Linux   
Latest Commit: Version Fixed/Implemented In:
Sentry Crash Report:

Description LeeP 2020-01-02 21:44:24 UTC 
SUMMARY
Discover Software Manager allows package updates without prompt for password authentication
STEPS TO REPRODUCE
1.Boot Discover  
2.Select Update Button
3. Select Update All 

OBSERVED RESULT
Updates package without password authentication.

EXPECTED RESULT
Dialoge box requiring password authentication before package update.


SOFTWARE/OS VERSIONS
Windows: 
macOS: 
Kubuntu: 18.04 
(available in About System)
KDE Plasma Version: 5.12.9
KDE Frameworks Version:5.44.0 
Qt Version: 5.9.5

ADDITIONAL INFORMATION
Kernal:5.3.0-26-generic
Comment 1 Nate Graham 2020-01-06 23:39:19 UTC 
This depends on entirely on the disreo's PackageKit authentication settings, which Discover then honors. openSUSE does the same thing IIRC.

If it's unnerving you, please report this to the Kubuntu people.