reports and permissions-a back door?

[mrhobbs]

Hello
I have created a user with read only access on one project only. When I log in as that user, I am able to see that one project, so that works fine.

However, when that user looks at the reports for that project, they are able to checkmark all projects and then able to access other projects for which they should be denied.

How can I prevent this from occuring? Are my permissions incorrect or is this a bug? Is there a work around available?

[mrhobbs]

possible workaround

I have disabled the "reports" link on the projects page. This is not ideal but prevents a client from accessing projects that should be denied. This was done by editing modules/projects/view.php. and changing the text of $titleBlock->addCrumb( "?m=projects&a=reports&project_id=$project_id", "reports" );

remove reports but leave the ""

if anyone has any ideas how to enable this for admin but not for clients, please let me know

[RodrigoDC]

Has this issue been resolved? Obviously deleting the reports link will prevent users form different companies/projects to see other companies/projects. However, this also prevents admins from generating reports.

Does anybody care to comment on how to restrict users form viewing ONLY the reports that corresponds to their companies and/or projects?

Thanks,
Rodrigo

[ronei.candido]

Hello, people ! My first post here !
I am enjoying this software, it is really nice. I think I "solved" this, maybe it helps for you. Following what I did for the role:
- Non-Admin Modules: allow view and deny other itens;
- Projects: deny everything;
- Projects again: allow view for the project I wanted.
And thats it. The "project report" link is still there, but when the user clicks in "all", it is showed the message "access denied". For the project related to the user, it works (at least for me).
It worked for me. Please let me know if worked for you as well !