Redmine

Interesting, it seems there might be a big issue indeed if author is anonymous (is this really possible?).

I haven't tested yet (hence the conditionnal), but this issue is worth being set as Confirmed so someone will have a look to it.

Your patch lacks the covering of the 'own' issue visibility setting and the Issue.visible_condition though.

Do you have any plugin installed?

Etienne, please take a look at #10148, which already covers this issue. Indeed, I only opened up this new report because nobody seemed to even notice that I proposed a fix for the bug. You may want to close one of the two reports as a duplicate of the other.

And it is rather easy to confirm this bug. No plugins "required" ;) meaning I can reproduce it in a bare installation of redmine. Just setup a redmine instance allowing private issues, as well as submission by anonymous users. Submit an issue while logged out. Mark it as private. Then, try to view the issue while logged in as a non-admin, non-privileged user -- you can't, because it is private. Then log out, and voila, you can view it.

Note that a colleague of mine independently discovered the problem when we were reviewing redmine along with several other issue trackers as candidates for our new issue tracking system. I subsequently analysed it, and then found #10148, where several other people report seeing this problem, too.

You are right, the patch is not covering the 'own' issue visibility setting. I was under the impression that it does not have to, as the test for whether an issue is in "own" visibility already checks if the user is logged in. But I guess it does not hurt to add the check there, too. It's also adds some symmetry - and thus might make a future refactoring of that code easier.

I was not aware of Issue.visible_condition, oops!

The new attached patch address all of this. It also fixes another case: private issues assigned to anonymous were still shown to anon users but hidden from logged in users. However, this code really screams for some refactoring.

Problem fixed in r10433 and the issues visibility option for the anonymous role is removed role in r10437 since 'all' and 'own' does not make sense for this role.

Merged into 2.1-stable.