alexbevi/redmine_knowledgebase — pull request #235 by xarlie (2014-03-17 22:33:29+00:00)
Title: Fixes cross-project access of articles and categories

This commit fixes a security issue where a user can access articles and categories from other projects by changing the id number at the end of the resource URL.

Example:
- User is a member of project **'general'** which has a KB article with ID **'1'** (user is allowed to read articles)
- User is not a member of project **'secret'** which has an article with ID **'2'**
- Gain access to **secret**'s article via this url: http://*host*/redmine/projects/**general**/knowledgebase/articles/**2**
- Similar behaviour for categories

After fix behaviour:
- Return a 404 on such a request