Defect #9405
closed
Any user with :log_time permission can edit time entries via context menu
0%
Description
In Redmine 1.2.0 or later any user can edit any time entries via context menu.
Example url: http://redmine/projects/testproject/time_entries and click right mouse button on any time entries.
img1.png - user have permission to edit any time entries
img2-4.png - user edit time entries without permission on it.
As you can see, user with permissions have icons for edit time report, but user without permissions can do this via context menu anyway.
PS: I set high priority to ticket. I think, this serious defect?
Files
Related issues
Updated by Mischa The Evil over 13 years ago
- Priority changed from High to Normal
I'm not able to reproduce this issue with source:/trunk@7623.
Are you sure that you were not testing this with an account configured as an administrator?
Updated by Toshi MARUYAMA over 13 years ago
This line has a bug.
source:trunk/app/controllers/context_menus_controller.rb#L54
Updated by Etienne Massip over 13 years ago
- Target version set to Candidate for next minor release
Updated by Mischa The Evil over 13 years ago
Ahh, I see... Thanks for your clarification on this Toshi. I was testing with an account that did not had the :log_time permission at all :-/
Updated by Jean-Philippe Lang over 13 years ago
- Target version changed from Candidate for next minor release to 1.2.3
Updated by Jean-Philippe Lang over 13 years ago
- Status changed from New to Resolved
See related commits.
Updated by Jean-Philippe Lang over 13 years ago
- Assignee set to Jean-Philippe Lang
Updated by 
Updated by Jevgen Gyrynovych over 13 years ago
- File redmine.rb.patch redmine.rb.patch added
I find some problem after apply the patch - when user tried to update ticket(e.g. nuber_of_ticket/edit), he dont have access to "Log time".
It fix that problem.
Updated by Jean-Philippe Lang over 13 years ago
I don't know what this patch is supposed to fix but :log_time should not allow the user to edit time entries.
I fixed a last point in r7924 which may be related to your fix.
Updated by Jean-Philippe Lang over 13 years ago
- Subject changed from any user can edit time entries via context menu to Any user with :log_time permission can edit time entries via context menu
- Status changed from Resolved to Closed
- Resolution set to Fixed
Merged in 1.2-stable.