Patch #29162: Only allow visible custom fields as aggregation criteria in time reports - Redmine

Actions

Copy link

Patch #29162

closed

Only allow visible custom fields as aggregation criteria in time reports

Added by Holger Just over 6 years ago. Updated over 6 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Go MAEDA

Category:

Time tracking

Target version:

4.0.0

Start date:

Due date:

% Done:

Estimated time:

Description

In time reports, the user can currently select any custom field defined in the Redmine system as an aggregation criteria. This can lead to confusion since the returned data might not reflect the custom field or might even lead to an information leak regarding the existence of a hidden custom field. The data returned in the report itself is correctly filtered so that the field is only considered if it is actually visible to the current user.

The attached patch filters the custom fields available as aggregation criteria in the report to only allow the use of visible custom fields.

Files

Download all files

0001-Only-allow-the-use-of-visible-custom-fields-in-time-.patch (2.59 KB) 0001-Only-allow-the-use-of-visible-custom-fields-in-time-.patch		Holger Just, 2018-06-29 17:27
29162@2x.png (55.4 KB) 29162@2x.png		Go MAEDA, 2018-07-12 07:50

Related issues

Actions

Copy link

Updated by Holger Just over 6 years ago

Related to Patch #29161: Avoid SQL errors when adding a project custom field as a time report criteria added

Actions

Copy link

Updated by Holger Just over 6 years ago

With just this patch, we can avoid the consequences of #29161 (at least I have not found any other place where this is an issue). Still, we should also apply #29161 to make the method save to use for ProjectCustomFields.

Actions

Copy link