In schema.py, I changed this:
    db.security.addPermissionToRole('User', 'View', 'issue')
to this:
    def own_issue(db, userid, itemid):
        return userid == db.issue.get(itemid, 'creator')
    p = db.security.addPermission(name='View', klass='issue',
check=own_issue)
    db.security.addPermissionToRole('User', p)

After this change, I found filter(filterspec, sort, group) stoped
working in issue.index, listing all issue that current user created,
regardless the filter applied in URL. This only affects User Role, while
Admin Role has no problem.

I put this:
    <span tal:content="request/filterspec"></span>
    <span tal:content="request/group"></span>
    <span tal:content="request/sort"></span>
in issue.index.html.
And I saw empty value in the not-working case mentioned above.

So issue.index.html doesn't get these value.