Merge r24443 from trunk to 6.0-stable (#43830).

git-svn-id: https://svn.redmine.org/redmine/branches/6.0-stable@24446 e93f8b46-1217-0410-a6f0-8f06a7374b81
2026-05-07 08:56:00 +02:00 · 2026-02-22 03:17:02 +00:00
parent b7fa930c61
commit 98e463e342
2 changed files with 8 additions and 0 deletions
--- a/app/controllers/timelog_controller.rb
+++ b/app/controllers/timelog_controller.rb
@@ -261,6 +261,8 @@ class TimelogController < ApplicationController

  def find_time_entry
    @time_entry = TimeEntry.find(params[:id])
+    raise Unauthorized unless @time_entry.visible?
+
    @project = @time_entry.project
  rescue ActiveRecord::RecordNotFound
    render_404