Defect #37729

Time entries listed/visible even for issues not accessible by user

Added by Attila Bognar 2 months ago. Updated 2 months ago.

Status:ClosedStart date:
Priority:NormalDue date:
Assignee:-% Done:

0%

Category:Time tracking
Target version:-
Resolution:Wont fix Affected version:4.2.7

Description

When time entries are listed for a project, even those are listed that are linked to non-accessible issues (either not accessible because of permissions or because they are private by another user).


Related issues

Duplicates Redmine - Defect #12287: Time entries of private issues are visible by users witho... Needs feedback

History

#1 Updated by Mischa The Evil 2 months ago

  • Status changed from New to Closed
  • Resolution set to Wont fix

Indeed, but I don't think it is a defect. Time entry visibility is (and has always been) independent of issue visibility. Time entries and issues aren't coupled in any way regarding object visibility.
Instead, time entry visibility depends entirely on the :view_time_entries permission together with the "time logs visibility" role setting that determines if the role can view all or own time entries only.

#2 Updated by Mischa The Evil 2 months ago

  • Duplicates Defect #12287: Time entries of private issues are visible by users without permission to see them added

#3 Updated by Attila Bognar 2 months ago

I can see it but cannot understand the logic behind it (I thought there is no other option because it is evident that the time entries of a non-accessable issue cannot be accessed; why would someone need to see the entries of an issue he cannot see?).

Also available in: Atom PDF