From e4ded41f9d31018da29e550d002fbe17bc24108b Mon Sep 17 00:00:00 2001
From: Victor Boctor <vboctor@gmail.com>
Date: Sat, 23 Jan 2016 02:08:28 +0000
Subject: [PATCH 1/3] Add access check / filtering for billing report

- In case of all projects, filter to user accessible ones.
- In case of a specific project, double check that user has access to it.

Fixes #20539
---
 core/bugnote_api.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/core/bugnote_api.php b/core/bugnote_api.php
index a508b70..2266c0f 100644
--- a/core/bugnote_api.php
+++ b/core/bugnote_api.php
@@ -705,10 +705,13 @@ function bugnote_stats_get_project_array( $p_project_id, $p_from, $p_to, $p_cost
 	}
 
 	if( ALL_PROJECTS != $p_project_id ) {
+		access_ensure_project_level( config_get( 'view_bug_threshold' ), $p_project_id );
+
 		$t_project_where = ' AND b.project_id = ' . db_param() . ' AND bn.bug_id = b.id ';
 		$t_params[] = $p_project_id;
 	} else {
-		$t_project_where = '';
+		$t_project_ids = current_user_get_accessible_projects();
+		$t_project_where = ' AND b.project_id in (' . implode( ', ', $t_project_ids ). ')';
 	}
 
 	if( !is_blank( $c_from ) ) {
-- 
1.9.1

From 03b20dd56c15088ed5119a5b82fc36ee897da411 Mon Sep 17 00:00:00 2001
From: Victor Boctor <vboctor@gmail.com>
Date: Sat, 23 Jan 2016 02:10:34 +0000
Subject: [PATCH 2/3] Add access check / filtering for billing exports

- In case of all projects, filter to user accessible ones.
- In case of a specific project, double check that user has access to it.

Fixes #20539
---
 core/billing_api.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/core/billing_api.php b/core/billing_api.php
index c2ddc49..12be079 100644
--- a/core/billing_api.php
+++ b/core/billing_api.php
@@ -67,10 +67,13 @@ function billing_get_for_project( $p_project_id, $p_from, $p_to, $p_cost_per_hou
 	}
 
 	if( ALL_PROJECTS != $p_project_id ) {
+		access_ensure_project_level( config_get( 'view_bug_threshold' ), $p_project_id );
+
 		$t_project_where = ' AND b.project_id = ' . db_param() . ' AND bn.bug_id = b.id ';
 		$t_params[] = $p_project_id;
 	} else {
-		$t_project_where = '';
+		$t_project_ids = current_user_get_accessible_projects();
+		$t_project_where = ' AND b.project_id in (' . implode( ', ', $t_project_ids ). ')';
 	}
 
 	if( !is_blank( $c_from ) ) {
-- 
1.9.1

From 171b72ca3381a8e1063224e275c88b662e8bdc09 Mon Sep 17 00:00:00 2001
From: Victor Boctor <vboctor@gmail.com>
Date: Sat, 23 Jan 2016 02:14:01 +0000
Subject: [PATCH 3/3] Use billing api for billing page access check

---
 billing_page.php | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/billing_page.php b/billing_page.php
index b62ebd4..ff6de97 100644
--- a/billing_page.php
+++ b/billing_page.php
@@ -32,16 +32,13 @@
 
 require_once( 'core.php' );
 require_api( 'access_api.php' );
+require_api( 'billing_api.php' );
 require_api( 'config_api.php' );
 require_api( 'constant_inc.php' );
 require_api( 'html_api.php' );
 require_api( 'lang_api.php' );
 
-if( !config_get( 'time_tracking_enabled' ) ) {
-	trigger_error( ERROR_ACCESS_DENIED, ERROR );
-}
-
-access_ensure_project_level( config_get( 'time_tracking_reporting_threshold' ) );
+billing_ensure_reporting_access();
 
 html_page_top( lang_get( 'time_tracking_billing_link' ) );
 ?>
-- 
1.9.1