Inconsistent documentation for visibility of time tracking report of private projects

Per #336535 (comment 633423449), we want to update the documentation to reflect that the Guest role can view the time tracking report. Original report included below for context

HackerOne report #1266959 by ashish_r_padelkar on 2021-07-17, assigned to GitLab Team:

Report | Attachments | How To Reproduce

Report

Summary

Hello,

As per this document https://docs.gitlab.com/ee/user/project/time_tracking.html#view-a-time-tracking-report , You must have at least the **Reporter** role for a project. to view time tracking report.

Also, as per this document https://docs.gitlab.com/ee/user/permissions.html guest users can only see time tracking report of public and internal projects and not private projects.

However, guest users can see time tracking report from all projects irrespective visibility set. ie. they can see from private projects too!. Looks like either this need documentation changes or proper permission check.

Steps to reproduce
  1. Create a private project .
  2. Create a public issue and add estimates and spend time in quick actions (in markdown editor) using below commands so that time tracking report gets generated for the issue.
    /estimate 1mo 2w 3d 4h 5m  
    /spend 1mo 2w 3d 4h 1m
  1. Login as Guest user in this project and navigate to issue created above.
  2. As per the documents referenced above, the time tracking report shouldn't be visible for this user as project is private. However, you can click on the time tracking report available on the right side bar of the issue!
  3. You can see the time tracking report in popup!

Screenshot_2021-07-18_at_01.28.18.png

What is the current bug behavior?

Guest user can see time tracking report on issues from private projects too which is against the documentation!

What is the expected correct behavior?

Only reporters or higher role should be able to view this time tracking report in private project!

Output of checks

This bug happens on GitLab.com GitLab Enterprise Edition 14.1.0-pre 10813d3bc2b

Regards,
Ashish

Impact

Guest user can see time tracking report on issues from private projects too which is against the documentation!
Severity is set as per CVSS calculated on hackerone report

Attachments

Warning: Attachments received through HackerOne, please exercise caution!

How To Reproduce

Please add reproducibility information to this section:

Edited by Jake Lear