Typing a ticket number into a search lets users see ticket summaries they shouldn't.
|Reported by:||stevemccusker@…||Owned by:||coderanger|
If the user enters # followed by a ticket number into the Trac search page, the ticket with that number will appear in the search results as a Quick Jump, even if they should not be able to see the ticket. This displays the ticket summary. If they click on the quick jump it doesn't display the page because they do not have permission to view it.
Howeve there are many situations where you do not want users to see even the summaries of the tickets that they do not have permission to view.
I am using 0.10.4 on Windows (XP and SBS 2003).
It doesn't do the quickjump if you enter # number into the search box on ordinary Wiki pages.