Opened 8 years ago

Closed 8 years ago

Last modified 5 years ago

#3674 closed defect (wontfix)

Private ticket permission users can get ticket counts that include tickets they're not allowed to view

Reported by: jevans Owned by: coderanger
Priority: normal Component: PrivateTicketsPlugin
Severity: minor Keywords:
Cc: Trac Release: 0.11


A user with private tickets permissions can still query how many tickets meet criteria even if they can't see the tickets listed or view them.

For instance they can type in query?status=!closed&priority=critical to get a count of how many critical defects are open.

Attachments (0)

Change History (5)

comment:1 Changed 8 years ago by coderanger

  • Resolution set to wontfix
  • Status changed from new to closed

This is a core trac issue. PrivateTickets is just a permission policy now.

comment:2 Changed 8 years ago by kontakt@…

  • Resolution wontfix deleted
  • Severity changed from normal to minor
  • Status changed from closed to reopened

As this is still an issue in 0.11.3, could you maybe please post a reference to the corresponding Trac dev ticket, if there is one? I've not been lucky to find out if the issue is already filed there or not.

I understand the plugin cannot influence the way the number of results matching a query is calculated in the main app. However, I would be interested if there's a chance the issue can be dealt with in trac itself or not.

I have no experience with python, so I don't see where in the trac source I would have to look to fix the problem myself ( I guess?). Maybe you can point me somewhere and I'll set my employed programmer on it to hack it and develop a patch maybe.

Thank you very much!

comment:3 Changed 8 years ago by jevans

See #t7608

comment:4 Changed 8 years ago by coderanger

  • Resolution set to wontfix
  • Status changed from reopened to closed

Don't reopen tickets just because you don't like the answer.

comment:5 Changed 5 years ago by rjollos

#9965 is a duplicate. I'll at least document the issue on the project wiki page.

Add Comment

Modify Ticket

as closed The owner will remain coderanger.
The resolution will be deleted. Next status will be 'reopened'.

E-mail address and user name can be saved in the Preferences.

Note: See TracTickets for help on using tickets.