Patch #27676
closedInformation leak on roadmap and versions view
0%
Description
When limiting a role's permission to only access "Issues created by or assigned to the user", the roadmap (/projects/:identifier/roadmap
) and version details (versions/:id
) view leaks information about inaccessible issues and time estimations. Due to missing permission checks in Version#fixed_issues the restricted user may see the overall number of issues, their status, tracker, author, category, and time estimations.
We think, this a security-relevant information leak and it should be fixed and announced responsibly. Attached you may find a proposed patch which includes tests and a fix.
The attached patch changes the Version model, so that the calculation methods (closed_issues_count
, open_issues_count
, etc) are now also available on the fixed_issues
relation proxy object. In a second step, all relevant places, where those calcuation methods are used, are updated to include the visible
scope. This fixes the roadmap view, the version details view and the version summary in the Gantt chart.
This bug was reported by a Planio user, the patch series was developed by Gregor Schmidt.
Files
Related issues