traggo / server

self-hosted tag-based time tracking
https://traggo.net
GNU General Public License v3.0
1.17k stars 58 forks source link

Data permission issues #100

Open muety opened 3 years ago

muety commented 3 years ago

Describe the bug Apparently, users are able to see data (time entries, dashboards) of other users. See the following screen cast for demonstration.

To Reproduce See screen cast.

Expected behavior Users only see their own data.

Screenshots

https://user-images.githubusercontent.com/8978843/135240669-10a4b8cc-fbf9-491e-82de-20e71f4e6b79.mp4

jmattheis commented 3 years ago

This is probably related to this old issue https://github.com/traggo/server/issues/56, the cache of the application doesn't get cleared on logout.