Defect #37729
closed
Time entries listed/visible even for issues not accessible by user
0%
Description
When time entries are listed for a project, even those are listed that are linked to non-accessible issues (either not accessible because of permissions or because they are private by another user).
Related issues
Updated by Mischa The Evil about 2 years ago
- Status changed from New to Closed
- Resolution set to Wont fix
Indeed, but I don't think it is a defect. Time entry visibility is (and has always been) independent of issue visibility. Time entries and issues aren't coupled in any way regarding object visibility.
Instead, time entry visibility depends entirely on the :view_time_entries permission together with the "time logs visibility" role setting that determines if the role can view all or own time entries only.
Updated by Mischa The Evil about 2 years ago
- Is duplicate of Defect #12287: Time entries of private issues are visible by users without permission to see them added
Updated by Attila Bognar about 2 years ago
I can see it but cannot understand the logic behind it (I thought there is no other option because it is evident that the time entries of a non-accessable issue cannot be accessed; why would someone need to see the entries of an issue he cannot see?).