Modify

#10281 closed defect (fixed)

DISCUSSION_ATTACH perm needed to be able to view an attachment

Reported by: sdegrande Owned by: rjollos
Priority: normal Component: DiscussionPlugin
Severity: normal Keywords:
Cc: Trac Release: 1.0

Description

I would suggest that DISCUSSION_VIEW should be enough to be granted to view the attachments of a topic.

Currently, DISCUSSION_ATTACH perm is needed, and as far as I understand, that perm is rather intended to grant the actual attachment of a file to a topic.

Here is a small patch to change the current behavior:

  • discussionplugin/0.11/tracdiscussion/api.py

    diff -r ec2c58e517b9 discussionplugin/0.11/tracdiscussion/api.py
    a b  
    155155 
    156156    def check_attachment_permission(self, action, username, resource, perm): 
    157157        if resource.parent.realm == 'discussion': 
    158             if action in ['ATTACHMENT_VIEW', 'ATTACHMENT_CREATE', 
    159               'ATTACHMENT_DELETE']: 
     158            if action in ['ATTACHMENT_CREATE', 'ATTACHMENT_DELETE']: 
    160159                return 'DISCUSSION_ATTACH' in perm(resource.parent) 
     160            elif action in ['ATTACHMENT_VIEW']: 
     161                return 'DISCUSSION_VIEW' in perm(resource.parent)  
    161162 
    162163    # IResourceManager methods. 

Thanks for your great work !

Attachments (0)

Change History (2)

comment:1 in reply to: ↑ description Changed 22 months ago by rjollos

  • Owner changed from Blackhex to rjollos
  • Status changed from new to assigned

Replying to sdegrande:

Currently, DISCUSSION_ATTACH perm is needed, and as far as I understand, that perm is rather intended to grant the actual attachment of a file to a topic.

I agree, DISCUSSION_ATTACH should only be required for adding or deleting an attachment. DISCUSSION_VIEW should be sufficient for viewing an attachment.

comment:2 Changed 22 months ago by rjollos

  • Resolution set to fixed
  • Status changed from assigned to closed

(In [12056]) Fixes #10281: Allow users with DISCUSSION_VIEW to also view attachments. Previously, DISCUSSION_ATTACH was required to view attachments. Thanks to sdegrande for the patch.

Add Comment

Modify Ticket

Action
as closed .
as The resolution will be set. Next status will be 'closed'.
to The owner will be changed from rjollos. Next status will be 'closed'.
The resolution will be deleted. Next status will be 'reopened'.
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.