0023223: Custom fields filter does not account for read access at project level - MantisBT

ID	Project	Category	View Status	Date Submitted	Last Update

0023223	mantisbt	filters	public	2017-08-15 11:56	2017-10-08 23:52

Reporter	cproensa	Assigned To	cproensa
Priority	normal	Severity	minor	Reproducibility	have not tried
Status	closed	Resolution	fixed
Product Version	2.6.0
Target Version	2.7.0	Fixed in Version	2.7.0

Summary	0023223: Custom fields filter does not account for read access at project level
Description	Filtering by a custom field value can show issues that matches the searched value, but the user does not have read access for according to that issue's project. Example: Having projects A, and B which is subrpoject of A. Both private. A custom field CF defined with "manager" read access A user that is member of project A as manager, and B as reporter. When the user is set is project A, and use a simple filter to search for the custom field value, issues from project B appear, even if the actual custom field value is not showed (it shows as empty, or 0)
Tags	No tags attached.

MantisBT: master fd38b5d3 2017-08-15 16:34 cproensa Committer: dregad Details Diff	Account for project permission on custom fields filter When filtering on custom fields, return only issues where the custom fields is viewable by the user according to each project access level. Fixes: 0023223		Affected Issues 0023223
	mod - core/filter_api.php		Diff File