Modify

Opened 3 years ago

Closed 3 years ago

#8870 closed defect (fixed)

Field permissions ignored in timeline

Reported by: ronino Owned by: bobbysmith007
Priority: normal Component: TimingAndEstimationPlugin
Severity: normal Keywords: waiting-for-feedback
Cc: Trac Release: 0.12

Description

I configured my Trac to not expose timing data to users without TIME_VIEW permission (with TIME_VIEW:remove in trac.ini). But in the timeline, those users still see that those fields have been changed (unlike in the ticket changelog where those information are hidden).

For example, the user can read in some timeline ticket change entry:

Add Hours to Ticket, Total Hours changed

In my opinion, those information should be removed from the timeline in those circumstances, otherwise those users wonder what those entries mean.

Attachments (0)

Change History (6)

comment:1 Changed 3 years ago by bobbysmith007

  • Status changed from new to assigned

It is definitely the intention that the timeline hide those details from users without permissions to them. Looking into this now.

comment:2 Changed 3 years ago by bobbysmith007

  • Resolution set to fixed
  • Status changed from assigned to closed

My guess is that these were not on the timeline in an earlier version of trac, or perhaps they were just missed since they had no data. Either way I just pushed a new version 1.1.6b that should correctly remove fields from the timeline for you.

[10267]

Thanks for the bug report

comment:3 Changed 3 years ago by ronino

  • Resolution fixed deleted
  • Status changed from closed to reopened

Man, you are fast as opposed to me ;-). Thanks again.

I installed the new version, but unfortunately, the timeline didn't change. Assuming that it maybe has to due with my using German as default language, I reset the labels to your strings and set English as frontend language, but changes of timing data fields are still visible for users without TIME_VIEW permission.

When installing the upgrade, I simply replaced the old plugin folder with the new one and restarted Apache. Did I miss something?

comment:4 Changed 3 years ago by bobbysmith007

You might need to enable the TimelinePermissionFilter in webadmin trac.ini depending on how you have stuff setup. If it is setup and enabled you should see "Timeline Filter" events in your trac debug log, whether or not it was working.

I dont think the label should change anything as we are using the value specified in the ini. It worked for me but it is definitely possible I missed something.

comment:5 Changed 3 years ago by bobbysmith007

  • Keywords waiting-for-feedback added

comment:6 Changed 3 years ago by bobbysmith007

  • Resolution set to fixed
  • Status changed from reopened to closed

Going to go ahead and close, if this is still a bug, please reopen.

Add Comment

Modify Ticket

Action
as closed .
as The resolution will be set. Next status will be 'closed'.
to The owner will be changed from bobbysmith007. Next status will be 'closed'.
The resolution will be deleted. Next status will be 'reopened'.
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.