Defect #28180: Role-base cross-project issue query visibility calculated incorrectly - Redmine

Actions

Copy link

Defect #28180

closed

Role-base cross-project issue query visibility calculated incorrectly

Added by Gregor Schmidt about 7 years ago. Updated almost 7 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Go MAEDA

Category:

Issues filter

Target version:

3.4.5

Start date:

Due date:

% Done:

Estimated time:

Resolution:

Fixed

Affected version:

Description

When saving a cross-project issue query and selecting role based visibility, the permission checks don't filter properly for archived projects (although this is generally done for global permissions).

An example: There's a "Manager's only" issue query. Paul and Perter are both managers and able to see the query. Now Paul's project is finished and his project is archived. Expected behaviour: He is no longer able to see the "Manager's only" view - in the same way he's no longer able to create new project. Desired behaviour: He should not be able to access the "Manager's only" view anymore.

Attached you may find a patch containing a test and proposed fix based on current trunk r17197.

Holger Just of Planio identified the bug and developed the attached fix.

Files

0001-Ignore-archived-project-memberships-when-calculating.patch (2.3 KB) 0001-Ignore-archived-project-memberships-when-calculating.patch

Gregor Schmidt, 2018-02-12 14:25