=== modified file 'trac/ticket/query.py'
--- trac/ticket/query.py	2008-10-31 16:50:36 +0000
+++ trac/ticket/query.py	2009-01-19 02:21:16 +0000
@@ -307,6 +307,8 @@
                     except TypeError, ValueError:
                         val = False
                 result[name] = val
+            if 'TICKET_VIEW' not in req.perm('ticket', result['id']):
+                continue
             results.append(result)
         cursor.close()
         return results