id,summary,reporter,owner,description,type,status,priority,component,severity,resolution,keywords,cc,release
9901,Billing page is visible to anonymous users,lguillaume@idatainc.com,bobbysmith007,The "Billing" page can be accessed by an anonymous user. I noticed this when logging in as a mostly unprivileged user that had REPORT_VIEW. I was able to access the Billing page_ which didn't seem right. While still on that page I logged out and the page remained!\r\n\r\nTested using the "regular" branch (0.11) and the permission-enabled one.\r\n\r\nTo reproduce: \r\n\r\n  * access a trac instance with timingandestimationplugin installed without logging in (or log out)\r\n  * go to the /Billing url\r\n  * Make some changes.\r\n  * see feedback that tickets are updated.\r\n\r\nI have not checked that tickets are actually touched. But the anonymous user should not have access to the Billing Page by default!\r\n\r\n,defect,closed,highest,TimingAndEstimationPlugin,critical,fixed,,,0.11