MantisBT: master 3476b161

Author Committer Branch Timestamp Parent
cproensa dregad master 2017-08-16 04:11 master fd38b5d3
Affected Issues  0016359: Custom field filters does not take user access rights into account
Changeset

Get accessible custom field values

Rewrite custom_field_distinct_values() to retrieve only those values
that are accessible by the user, according to either issue view
permission, or custom field definition for view access level.

Only values that are viewable by the user should be retrieved, so we
must account for:

  • View issue permissions: if the issue is private or public.
  • Project level permissions: if a private project is accessible
    directly, or indirectly.
  • Limit view issues for reporters: if the option is enabled.
  • Custom field definition for viewing threshold

Viewable issues can be resolved by using a filter, which already
accounts for those restrictions. So here we only need to additionally
check for custom field view threshold on each project.

Fixes: 0016359

mod - core/custom_field_api.php Diff File