Vote #79092
未完了Queries 403 error if query author is not in the roles list
ステータス:
New
優先度:
通常
担当者:
-
カテゴリ:
-
対象バージョン:
-
開始日:
2022/05/09
期日:
進捗率:
0%
予定工数:
Redmineorg_URL:
category_id:
0
version_id:
0
issue_org_id:
28069
author_id:
123866
assigned_to_id:
0
comments:
0
status_id:
1
tracker_id:
1
plus1:
0
affected_version:
closed_on:
affected_version_id:
説明
How to reproduce (with vanilla redmine 3.4):
- Go to a project where you are a member with Role A
- create a query and save it. make it visible to Role B
- Save the query
Result:
- Error 403
In my opinion, a query should always be visible to its author, provided that he has sufficient rights to access the project.
How to fix it:
Here: https://github.com/redmine/redmine/blob/7fd04e1f8d36d78ee4f680d0a312c9eac2c65e90/app/models/query.rb#L339
In the case above, a simple check on @user == self.user@ should fix the problem
表示するデータがありません