Modify

Opened 7 years ago

Closed 7 years ago

#2088 closed defect (wontfix)

TAGS_MODIFY does not prevent modification of ticket keywords

Reported by: dkg-debian.org@… Owned by: athomas
Priority: normal Component: TagsPlugin
Severity: normal Keywords:
Cc: Trac Release: 0.11

Description

if TAGS_MODIFY is to be an effective permission, it should not only limit the ability to set tags on wiki pages. It should also limit the ability to set whichever of the ticket fields are parsed for the tags.

This probably means that TagsPlugin should implement an ITicketManipulator interface and filter out any attempts to modify either keywords or the items specified in the fields setting under [tags.ticket] in trac.ini if the user does not have the TAGS_MODIFY permission in the relevant context.

Future ITaggingSystemProvider authors should include similar precautions for their implementations.

Thanks for this great plugin! It's very useful. Sorry that i don't have a patch for you at the moment.

Attachments (0)

Change History (1)

comment:1 Changed 7 years ago by athomas

  • Resolution set to wontfix
  • Status changed from new to closed

I disagree that Tags should restrict permissions for resources being tagged. It's up to the underlying resource handler to do that.

That being said, the flexible permission system in Trac 0.11 is supported by Tags 0.6 and may provide what you want.

Add Comment

Modify Ticket

Action
as closed .
The resolution will be deleted. Next status will be 'reopened'.
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.