0023505: Filtering by relationship, shows results for relations not viewable by the user - MantisBT

ID	Project	Category	View Status	Date Submitted	Last Update

0023505	mantisbt	filters	public	2017-10-19 13:47	2017-10-21 11:53

Reporter	cproensa	Assigned To
Priority	normal	Severity	minor	Reproducibility	have not tried
Status	new	Resolution	open
Product Version	2.8.0

Summary	0023505: Filtering by relationship, shows results for relations not viewable by the user
Description	For example issue A is viewable by the user issue B is not viewable. both issues have a relation. User searchs for "issues related to B", and gets A as a result. If the relation is not visible to the user, this result shouldn't be shown.
Tags	No tags attached.

cproensa 2017-10-21 11:53 developer ~0058010	The impact for this is very low: it's reproducible only by knowing the id of the "invisible" bug id beforehand. Fixing this at the filter query may be complicated. Maybe it's easier by building the query with CTEs: WITH visible_bugs AS (...) etc But that is not implemented in all supported databases: mysql >= v8 mariadb >= 10.2.1 I think we can leave this as won't fix at this moment