Modify

Opened 2 years ago

Closed 2 years ago

#10281 closed defect (fixed)

DISCUSSION_ATTACH perm needed to be able to view an attachment

Reported by: sdegrande Owned by: rjollos
Priority: normal Component: DiscussionPlugin
Severity: normal Keywords:
Cc: Trac Release: 1.0

Description

I would suggest that DISCUSSION_VIEW should be enough to be granted to view the attachments of a topic.

Currently, DISCUSSION_ATTACH perm is needed, and as far as I understand, that perm is rather intended to grant the actual attachment of a file to a topic.

Here is a small patch to change the current behavior:

  • discussionplugin/0.11/tracdiscussion/api.py

    diff -r ec2c58e517b9 discussionplugin/0.11/tracdiscussion/api.py
    a b  
    155155
    156156    def check_attachment_permission(self, action, username, resource, perm):
    157157        if resource.parent.realm == 'discussion':
    158             if action in ['ATTACHMENT_VIEW', 'ATTACHMENT_CREATE',
    159               'ATTACHMENT_DELETE']:
     158            if action in ['ATTACHMENT_CREATE', 'ATTACHMENT_DELETE']:
    160159                return 'DISCUSSION_ATTACH' in perm(resource.parent)
     160            elif action in ['ATTACHMENT_VIEW']:
     161                return 'DISCUSSION_VIEW' in perm(resource.parent)
    161162
    162163    # IResourceManager methods.

Thanks for your great work !

Attachments (0)

Change History (2)

comment:1 in reply to: ↑ description Changed 2 years ago by rjollos

  • Owner changed from Blackhex to rjollos
  • Status changed from new to assigned

Replying to sdegrande:

Currently, DISCUSSION_ATTACH perm is needed, and as far as I understand, that perm is rather intended to grant the actual attachment of a file to a topic.

I agree, DISCUSSION_ATTACH should only be required for adding or deleting an attachment. DISCUSSION_VIEW should be sufficient for viewing an attachment.

comment:2 Changed 2 years ago by rjollos

  • Resolution set to fixed
  • Status changed from assigned to closed

(In [12056]) Fixes #10281: Allow users with DISCUSSION_VIEW to also view attachments. Previously, DISCUSSION_ATTACH was required to view attachments. Thanks to sdegrande for the patch.

Add Comment

Modify Ticket

Action
as closed The owner will remain rjollos.
The resolution will be deleted. Next status will be 'reopened'.
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.