[patch] You can't delete a PDF attachment when PDFRedirector is enabled.

[lburaggi@…]

How can i delete a PDF attachment when PDFRedirector is enabled ? The only work around I found is:

1. Disabling the PDFRedirector Plugin in the Admin page
2. Showing the attachment preview page that contains the Delete button and deleting the attachment
3. Re-enabling the plugin.

Note that you need TRAC_ADMIN permission to do that.

I would like an easier way to delete PDF attachments, not requiring high level permissions.

[Steffen Hoffmann]

Replying to lburaggi@mate.it:

How can i delete a PDF attachment when PDFRedirector is enabled ?

Glad you ask. Bit me too. I was just looking for a place to add the fix I worked out tonight.

Note that you need TRACK_ADMIN permission to do that.

Not true. Actually permission required are (from trac.attachment.LegacyAttachmentPolicy) defined as following:

        'ATTACHMENT_DELETE': {'ticket': 'TICKET_ADMIN', 'wiki': 'WIKI_DELETE',
                              'milestone': 'MILESTONE_DELETE'}

so this it's depending on the parent resource's realm the file is attached to. TRACK_ADMIN does work too because it simply inherits any permission defined on the current system, weather defined in Trac core or a plugin.

I would like an easier way to delete PDF attachments, not requiring high level permissions.

See before.

True, there is no ATTACHMENT_DELETE or even ATTACHMENT_ADMIN for convenience, maybe on-purpose.? You could ask at the trac-dev mailing-list, if you care. At least it's a reasonable default, matching the unwritten "feature-rich might be feature-bloat" policy of Trac nicely, you see? I like the low-fuss concept, so that still works-for-me.

Well, the fix, right? Alter the plugin source like so:

pdfredirector/pdfredirector.py

@@ -46 +46 @@
         if len(path) < 2 or path[0] != 'attachment':
             return handler
 
-        if not path[-1].lower().endswith('.pdf'):
+        if not path[-1].lower().endswith('.pdf') or req.args.get('action'):
             return handler
 
         filename = req.href(*(['raw-attachment'] + path[1:]))

Now it's at least possible to delete again by regular web-UI access via URL query args:

<env>/attachment/<parent-realm>/<parent-id>/<attachment-filename>?action=delete

Means no <Delete> button (yet) like on preview page for other attachments, just pure functionality, sorry. A more elaborated way to access the delete functionality might follow. Needed?

[Steffen Hoffmann]

I'm asking kindly for patch review, or permission to do a non-maintainer-upload of this change, in case the plugin author is incapable of devoting the time needed for doing this alone, or if unresponsive/unavailable much longer. What do you think?

Side-note: Another occasion, that make me think about an explicit policy for non-maintainer interception in case of security considerations or overdue issues without response from author/last maintainer, similar to AdoptingHacks, but without expressed desire to permanently take-over control and responsibility - our pending QA team approach.

[Ryan J Ollos]

I'm using this plugin now, so decided to go ahead and fix this. It is working with 1.0dev, so I've added the 0.12 and 1.0 tags to the project wiki page.