kimai/kimai — pull request #444 by ServiusHack (2014-12-27 12:58:50+00:00)
Title: Prevent bypassing permissions using filters.

It was possible to see customers, projects or activities you have no
permission to see by filtering by a user which has entries for any of
these.

This is now prevented by always including the allowed customers,
projects and activities when querying the database. When a filter is
applied the intersection between the set of all allowed IDs and the set
of the selected IDs is used.