プロジェクト

全般

プロフィール

Vote #81550

完了

Attachments deletable even though issue edit not permitted

Admin Redmine さんが約4年前に追加. 約4年前に更新.

ステータス:
Closed
優先度:
通常
担当者:
-
カテゴリ:
Permissions and roles_17
対象バージョン:
開始日:
2022/05/09
期日:
進捗率:

0%

予定工数:
category_id:
17
version_id:
169
issue_org_id:
35634
author_id:
48214
assigned_to_id:
107353
comments:
7
status_id:
5
tracker_id:
1
plus1:
0
affected_version:
closed_on:
affected_version_id:
165
ステータス-->[Closed]

説明

If role A has permission to edit issues in tracker X but not in tracker Y, members of this role can delete attachments in issues with tracker Y.

This commit fixes this for @attachments_editable?@ r15476. Likewise this should be done in @/app/models/issue.rb@:

  # Overrides Redmine::Acts::Attachable::InstanceMethods#attachments_deletable?
  def attachments_deletable?(user=User.current)
    attributes_editable?(user)
  end

journals

#24623 solves this issue but does a lot more...
--------------------------------------------------------------------------------
Issue and given fix confirmed. Adding the given method to @Issue@ fixes this by properly taking tracker permissions into account (i.e. @:edit_issue@ permission needed for tracker Y to delete attachments attached to an issue with set tracker Y).

D G wrote:
> #24623 solves this issue but does a lot more...

Indeed. It implements full CRUD-permissions for issue attachments. I think it would be nice to have it integrated into the core, however the provided patch as-is is pretty big and, sadly, is currently outdated and will likely break the existing test suite and comes without any test coverage for the new features itself.
I've had a quick look into the patch implementation though and it all _seems_ properly implemented (albeit to obviously outdated checkouts). It shouldn't be all too hard to rebase it onto the current trunk. Updating the test suite for the patch and testing (for) and handling (of) any possible edge-cases will be most of the required work to get it ready for a decision on core integration.
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
I've added two patches:
* first one adds tests for r15476
* second one fixes this issue and add tests.
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
Patches committed.
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------

Admin Redmine さんが約4年前に更新

  • カテゴリPermissions and roles_17 にセット
  • 対象バージョン4.1.5_169 にセット

他の形式にエクスポート: Atom PDF

いいね!0
いいね!0