I just created a private "tracker" site and noticed that the project_issue_all_projects View doesn't require "access content" permission, which I think it should.

The view doesn't actually show any data to an anonymous user without "access content" permission, but ideally we wouldn't show a link that they can't use.

Comments

dww’s picture

Status: Active » Closed (duplicate)