Permissions on the history module

[John]

I have some problems with the permissions on the history module. When I'm trying to access to this module with a user who hasn't the permission's on a project (e.g X) I can see all messages (included X's message). In the source code I have noted that there is a different security policy from other modules (e.g projects, tasks, files...), is it right?
Thanks for your answers,
John