Opened 10 years ago

Closed 7 years ago

#2754 closed defect (invalid)

Tag Permission Checks Should Have Parent Resources

Reported by: John Hampton Owned by: Alec Thomas
Priority: normal Component: TagsPlugin
Severity: normal Keywords: resource parent permission
Cc: John Hampton, Ryan J Ollos, Michael Renzmann, Jun Omae, osimons, Mitar Trac Release: 0.11


Currently, the tag resources passed to the IPermissionPolicy interfaces have no parent resources. They should have parent resource to indicate where the tags exist

Attachments (0)

Change History (3)

comment:1 Changed 10 years ago by Alec Thomas

Can you recall where this was the case?

comment:2 Changed 9 years ago by Ryan J Ollos

Cc: Ryan J Ollos added

comment:3 Changed 7 years ago by Steffen Hoffmann

Cc: Michael Renzmann Jun Omae osimons Mitar added
Keywords: resource parent permission added
Resolution: invalid
Status: newclosed

Your complaint is rather artificial.

The only place where we currently use tag resources is in, and there both times it is to instantiate a resource object for render_resource_link() that doesn't utilize permission checks AFAIK.

No question, we don't have a way to auto-retrieve the corresponding parent (resource) when instantiating a tag resource. But we don't discuss something similar to attachments here. I consider this a next-to-nonsense task in a common TracTags application, where you normally find more than one resource tagged with a given tag, so there's no distinct parent to refer to. On top of this I guess, it would be just another performance hit (#4503). And what would the full list of tagged resources be good for inside every tag resource object?

Plus: In general permission checks in this plugin are done straight on the parent resource as required, as far as I can see. I.e. have a look at [10789] for hints where these places are.

Frankly I can't see a place where we would miss and need the tag resource parent. And in the absence of a reasonable use case this is a none-issue, right? Feel free to reopen, if you can provide details, that might let this defect report look more valid. It would still become an enhancement request then, I guess...

Modify Ticket

Change Properties
Set your email in Preferences
as closed The owner will remain Alec Thomas.
The resolution will be deleted.

Add Comment

E-mail address and name can be saved in the Preferences.

Note: See TracTickets for help on using tickets.