Modify

Opened 8 years ago

Closed 8 years ago

Last modified 5 years ago

#3674 closed defect (wontfix)

Private ticket permission users can get ticket counts that include tickets they're not allowed to view

Reported by: J Evan S Owned by: Noah Kantrowitz
Priority: normal Component: PrivateTicketsPlugin
Severity: minor Keywords:
Cc: Trac Release: 0.11

Description

A user with private tickets permissions can still query how many tickets meet criteria even if they can't see the tickets listed or view them.

For instance they can type in query?status=!closed&priority=critical to get a count of how many critical defects are open.

Attachments (0)

Change History (5)

comment:1 Changed 8 years ago by Noah Kantrowitz

Resolution: wontfix
Status: newclosed

This is a core trac issue. PrivateTickets is just a permission policy now.

comment:2 Changed 8 years ago by kontakt@…

Resolution: wontfix
Severity: normalminor
Status: closedreopened

As this is still an issue in 0.11.3, could you maybe please post a reference to the corresponding Trac dev ticket, if there is one? I've not been lucky to find out if the issue is already filed there or not.

I understand the plugin cannot influence the way the number of results matching a query is calculated in the main app. However, I would be interested if there's a chance the issue can be dealt with in trac itself or not.

I have no experience with python, so I don't see where in the trac source I would have to look to fix the problem myself (query.py I guess?). Maybe you can point me somewhere and I'll set my employed programmer on it to hack it and develop a patch maybe.

Thank you very much!

comment:3 Changed 8 years ago by J Evan S

See #t7608

comment:4 Changed 8 years ago by Noah Kantrowitz

Resolution: wontfix
Status: reopenedclosed

Don't reopen tickets just because you don't like the answer.

comment:5 Changed 5 years ago by Ryan J Ollos

#9965 is a duplicate. I'll at least document the issue on the project wiki page.

Modify Ticket

Action
as closed The owner will remain Noah Kantrowitz.
The resolution will be deleted. Next status will be 'reopened'.

Add Comment


E-mail address and name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.