When you go to see an issue, there is a history tab.
If you go consult this history tab, you can see intel that you're not supposed to see because there seems to be no rights management on this tab.
For example, you can see all the time logged by the tempo-timesheet service on this issue, even if you don't have any rights on the tempo module.
This is a major issue for us, as it breaks our confidentiality protocol, and right now, we don't have any solution on that.
Does anyone knows a workaround ?
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.