Changeset 2614

Timestamp:

09/03/07 06:07:21 (1 year ago)

Author:

athomas

Message:

ticket.update() now requires TICKET_ADMIN. This is simply a matter of
expedience, as reimplementing the logic to correctly apply permissions to an
update is quite a bit of effort, but allowing anybody with TICKET_APPEND to
modify any field is unacceptable.

Files:

• xmlrpcplugin/trunk/tracrpc/ticket.py (modified) (1 diff)
• xmlrpcplugin/trunk/tracrpc/web_ui.py (modified) (1 diff)

xmlrpcplugin/trunk/tracrpc/ticket.py

@@ -29 +29 @@
-        yield ('TICKET_VIEW', ((list, int),), self.get)
-        yield ('TICKET_CREATE', ((int, str, str), (int, str, str, dict), (int, str, str, dict, bool)), self.create)
-PPEND
+DMIN
-        yield ('TICKET_ADMIN', ((None, int),), self.delete)
-        yield ('TICKET_VIEW', ((dict, int), (dict, int, int)), self.changeLog)

xmlrpcplugin/trunk/tracrpc/web_ui.py

@@ -34 +34 @@
-        # Dump RPC functions
-        content_type = req.get_header('Content-Type') or 'text/html'
-        self.env.log.debug(content_type)
-        if not self.content_type_re.match(content_type):
-            namespaces = {}