Please find attached a diff file which contains:

* a system test to reproduce the error
* a patch to fix it

Thank you for considering this patch.

<pre><code class="ruby">
def test_create_issue_with_attachment_when_user_is_not_a_member
set_tmp_attachments_directory

# Set no permission to non-member role
non_member_role = Role.where(:builtin => Role::BUILTIN_NON_MEMBER).first
non_member_role.permissions = []
non_member_role.save

# Set role "Reporter" to non-member users on project ecookbook
membership = Member.find_or_create_by(user_id: Group.non_member.id, project_id: 1)
membership.roles = [Role.find(3)] # Reporter
membership.save

log_user('someone', 'foo')

issue = new_record(Issue) do
visit '/projects/ecookbook/issues/new'
fill_in 'Subject', :with => 'Issue with attachment'
attach_file 'attachments[dummy][file]', Rails.root.join('test/fixtures/files/testfile.txt')
fill_in 'attachments[1][description]', :with => 'Some description'
click_on 'Create'
end
assert_equal 1, issue.attachments.count
assert_equal 'Some description', issue.attachments.first.description
end
</code></pre>

<pre><code class="diff">
# authorize if user has at least one role that has this permission
- roles = self.roles.to_a | [builtin_role]
+ roles = self.roles.to_a | [builtin_role] | Group.non_member.roles.to_a | Group.anonymous.roles.to_a
roles.any? {|role|
role.allowed_to?(action) && ...
</code></pre>
--------------------------------------------------------------------------------
Moving this to a major version (version:4.2.0) because the proposed patch moves a method from one class to another.
--------------------------------------------------------------------------------
Need more time to review and fix.
--------------------------------------------------------------------------------
+1

Hand applied the patch to my 4.2.2 system ( app/models/user.rb reformatted def roles) and it appears to solve the problem.
--------------------------------------------------------------------------------
I have the same problem. I'm on :

<pre>
Environment:
Redmine version 4.2.3.stable
Ruby version 2.6.9-p207 (2021-11-24) [x86_64-linux]
Rails version 5.2.6
Environment production
Database adapter Mysql2
Mailer queue ActiveJob::QueueAdapters::AsyncAdapter
Mailer delivery smtp
SCM:
Subversion 1.14.1
Git 2.34.1
Filesystem
Redmine plugins:
</pre>

I tried to add the tweak to user.rb like @Rob Logan did, but sadly it does not work for me :- (
It actually broke more and I have Internal Error instead now.

Any hints? I want to allow self-registered-authenticated users to attach attachments...

--------------------------------------------------------------------------------
Dariusz Makowski wrote:
> I have the same problem. I'm on :
>
> [...]
>
> I tried to add the tweak to user.rb like @Rob Logan did, but sadly it does not work for me :- (
> It actually broke more and I have Internal Error instead now.
>
> Any hints? I want to allow self-registered-authenticated users to attach attachments...

Can you check in the logs what error do you receive?
--------------------------------------------------------------------------------
Vincent, what do you think about the following fix?

I tried to fix the method @User#roles@ to include the roles assigned to @Group Non Member@ or @Group Anonymous Users@ groups. For example, @roles_for_project@ already do this.

Also, only the roles assigned to public projects are included in the query.
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
Hello Marius. Thank you for this update.

About the fix, I think we should cumulate these roles.
A member should never have fewer permissions than a non-member ; a non-member should never have fewer permissions than an anonymous.

As I see it, a member should have all the permissions granted to these roles : @member.roles + non_member.roles + anonymous.roles@
--------------------------------------------------------------------------------
@roles_for_project@ (source:/trunk/app/models/user.rb#L637) doesn't do this, it overrides the roles only if the user is not a member. At the same time, being a global context, I agree that it makes sense to cumulate them or do cumulate the roles from public projects where the user is not a member.

Being a quite important design choice, I would like more feedback.

What do you think if I commit the fix just for this issue for now to catch the next releases and discuss more in a different issue?
--------------------------------------------------------------------------------
Vincent Robert wrote:
> About the fix, I think we should cumulate these roles.
> A member should never have fewer permissions than a non-member ; a non-member should never have fewer permissions than an anonymous.

I am against the change. I think it is confusing if the set of permissions for a role is different from as configured. And the change may damage the flexibility of permissions and roles.
--------------------------------------------------------------------------------
It may actually be a different topic. I agree, we can first fix the bug with the 403 error, without modifying current roles' inheritance.
--------------------------------------------------------------------------------
Applied in changeset r21502.
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------