[patch] You can't delete a PDF attachment when PDFRedirector is enabled.

Replying to lburaggi@mate.it:

How can i delete a PDF attachment when PDFRedirector is enabled ?

Glad you ask. Bit me too. I was just looking for a place to add the fix I worked out tonight.

Note that you need TRACK_ADMIN permission to do that.

Not true. Actually permission required are (from trac.attachment.LegacyAttachmentPolicy) defined as following:

        'ATTACHMENT_DELETE': {'ticket': 'TICKET_ADMIN', 'wiki': 'WIKI_DELETE',
                              'milestone': 'MILESTONE_DELETE'}

so this it's depending on the parent resource's realm the file is attached to. TRACK_ADMIN does work too because it simply inherits any permission defined on the current system, weather defined in Trac core or a plugin.

I would like an easier way to delete PDF attachments, not requiring high level permissions.

See before.

True, there is no ATTACHMENT_DELETE or even ATTACHMENT_ADMIN for convenience, maybe on-purpose.? You could ask at the trac-dev mailing-list, if you care. At least it's a reasonable default, matching the unwritten "feature-rich might be feature-bloat" policy of Trac nicely, you see? I like the low-fuss concept, so that still works-for-me.

Well, the fix, right? Alter the plugin source like so:

--- pdfredirector/pdfredirector.py
+++ pdfredirector/pdfredirector.py
@@ -46,7 +46,7 @@
         if len(path) < 2 or path[0] != 'attachment':
             return handler
 
-        if not path[-1].lower().endswith('.pdf'):
+        if not path[-1].lower().endswith('.pdf') or req.args.get('action'):
             return handler
 
         filename = req.href(*(['raw-attachment'] + path[1:]))

Now it's at least possible to delete again by regular web-UI access via URL query args:

<env>/attachment/<parent-realm>/<parent-id>/<attachment-filename>?action=delete

Means no <Delete> button (yet) like on preview page for other attachments, just pure functionality, sorry. A more elaborated way to access the delete functionality might follow. Needed?

I'm asking kindly for patch review, or permission to do a non-maintainer-upload of this change, in case the plugin author is incapable of devoting the time needed for doing this alone, or if unresponsive/unavailable much longer. What do you think?

Side-note: Another occasion, that make me think about an explicit policy for non-maintainer interception in case of security considerations or overdue issues without response from author/last maintainer, similar to AdoptingHacks, but without expressed desire to permanently take-over control and responsibility - our pending QA team approach.

I'm using this plugin now, so decided to go ahead and fix this. It is working with 1.0dev, so I've added the 0.12 and 1.0 tags to the project wiki page.

(In [11784]) Fixes #8583: version 0.2

• Allow attachment to be deleted if action is delete. To delete an attachment, enter the following URL: /attachment/realm/filename.pdf?action=delete. Thanks to hasienda for the patch.
• Formatting and style changes to source code.

I think the request in this ticket was satisfied, so I've closed it. What would really make the plugin useful though, would be to find someway to implement #5710. Then, we could still have a Delete button at the bottom of the page in which PDF is rendered.