Modify

Opened 2 years ago

Closed 2 years ago

#10281 closed defect (fixed)

DISCUSSION_ATTACH perm needed to be able to view an attachment

Reported by: sdegrande Owned by: rjollos
Priority: normal Component: DiscussionPlugin
Severity: normal Keywords:
Cc: Trac Release: 1.0

Description

I would suggest that DISCUSSION_VIEW should be enough to be granted to view the attachments of a topic.

Currently, DISCUSSION_ATTACH perm is needed, and as far as I understand, that perm is rather intended to grant the actual attachment of a file to a topic.

Here is a small patch to change the current behavior:

  • discussionplugin/0.11/tracdiscussion/api.py

    diff -r ec2c58e517b9 discussionplugin/0.11/tracdiscussion/api.py
    a b  
    155155 
    156156    def check_attachment_permission(self, action, username, resource, perm): 
    157157        if resource.parent.realm == 'discussion': 
    158             if action in ['ATTACHMENT_VIEW', 'ATTACHMENT_CREATE', 
    159               'ATTACHMENT_DELETE']: 
     158            if action in ['ATTACHMENT_CREATE', 'ATTACHMENT_DELETE']: 
    160159                return 'DISCUSSION_ATTACH' in perm(resource.parent) 
     160            elif action in ['ATTACHMENT_VIEW']: 
     161                return 'DISCUSSION_VIEW' in perm(resource.parent)  
    161162 
    162163    # IResourceManager methods. 

Thanks for your great work !

Attachments (0)

Change History (2)

comment:1 in reply to: ↑ description Changed 2 years ago by rjollos

  • Owner changed from Blackhex to rjollos
  • Status changed from new to assigned

Replying to sdegrande:

Currently, DISCUSSION_ATTACH perm is needed, and as far as I understand, that perm is rather intended to grant the actual attachment of a file to a topic.

I agree, DISCUSSION_ATTACH should only be required for adding or deleting an attachment. DISCUSSION_VIEW should be sufficient for viewing an attachment.

comment:2 Changed 2 years ago by rjollos

  • Resolution set to fixed
  • Status changed from assigned to closed

(In [12056]) Fixes #10281: Allow users with DISCUSSION_VIEW to also view attachments. Previously, DISCUSSION_ATTACH was required to view attachments. Thanks to sdegrande for the patch.

Add Comment

Modify Ticket

Action
as closed .
The resolution will be deleted. Next status will be 'reopened'.
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.