Opened 6 years ago

Closed 4 years ago

# [patch] You can't delete a PDF attachment when PDFRedirector is enabled.

Reported by: Owned by: lburaggi@… rjollos normal PdfRedirectorPlugin normal attachment delete otaku42 0.11

How can i delete a PDF attachment when PDFRedirector is enabled ? The only work around I found is:

1. Disabling the PDFRedirector Plugin in the Admin page
2. Showing the attachment preview page that contains the Delete button and deleting the attachment
3. Re-enabling the plugin.

Note that you need TRAC_ADMIN permission to do that.

I would like an easier way to delete PDF attachments, not requiring high level permissions.

### comment:1 in reply to: ↑ description Changed 5 years ago by hasienda

• Cc rjollos added; anonymous removed
• Summary changed from You can't delete a PDF attachment when PDFRedirector is enabled. to [patch] You can't delete a PDF attachment when PDFRedirector is enabled.

How can i delete a PDF attachment when PDFRedirector is enabled ?

Glad you ask. Bit me too. I was just looking for a place to add the fix I worked out tonight.

Note that you need TRACK_ADMIN permission to do that.

Not true. Actually permission required are (from trac.attachment.LegacyAttachmentPolicy) defined as following:

        'ATTACHMENT_DELETE': {'ticket': 'TICKET_ADMIN', 'wiki': 'WIKI_DELETE',
'milestone': 'MILESTONE_DELETE'}


so this it's depending on the parent resource's realm the file is attached to. TRACK_ADMIN does work too because it simply inherits any permission defined on the current system, weather defined in Trac core or a plugin.

I would like an easier way to delete PDF attachments, not requiring high level permissions.

See before.

True, there is no ATTACHMENT_DELETE or even ATTACHMENT_ADMIN for convenience, maybe on-purpose.? You could ask at the trac-dev mailing-list, if you care. At least it's a reasonable default, matching the unwritten "feature-rich might be feature-bloat" policy of Trac nicely, you see? I like the low-fuss concept, so that still works-for-me.

Well, the fix, right? Alter the plugin source like so:

• ## pdfredirector/pdfredirector.py

 if len(path) < 2 or path[0] != 'attachment': return handler if not path[-1].lower().endswith('.pdf'): if not path[-1].lower().endswith('.pdf') or req.args.get('action'): return handler filename = req.href(*(['raw-attachment'] + path[1:]))

Now it's at least possible to delete again by regular web-UI access via URL query args:

<env>/attachment/<parent-realm>/<parent-id>/<attachment-filename>?action=delete

Means no <Delete> button (yet) like on preview page for other attachments, just pure functionality, sorry. A more elaborated way to access the delete functionality might follow. Needed?

### comment:2 Changed 5 years ago by hasienda

I'm asking kindly for patch review, or permission to do a non-maintainer-upload of this change, in case the plugin author is incapable of devoting the time needed for doing this alone, or if unresponsive/unavailable much longer. What do you think?

Side-note: Another occasion, that make me think about an explicit policy for non-maintainer interception in case of security considerations or overdue issues without response from author/last maintainer, similar to AdoptingHacks, but without expressed desire to permanently take-over control and responsibility - our pending QA team approach.

### comment:3 Changed 4 years ago by rjollos

• Cc rjollos removed
• Description modified (diff)
• Owner changed from nicholasbs to rjollos
• Status changed from new to assigned

I'm using this plugin now, so decided to go ahead and fix this. It is working with 1.0dev, so I've added the 0.12 and 1.0 tags to the project wiki page.

### comment:4 Changed 4 years ago by rjollos

• Resolution set to fixed
• Status changed from assigned to closed

(In [11784]) Fixes #8583: version 0.2

• Allow attachment to be deleted if action is delete. To delete an attachment, enter the following URL: /attachment/realm/filename.pdf?action=delete. Thanks to hasienda for the patch.
• Formatting and style changes to source code.

### comment:5 Changed 4 years ago by rjollos

I think the request in this ticket was satisfied, so I've closed it. What would really make the plugin useful though, would be to find someway to implement #5710. Then, we could still have a Delete button at the bottom of the page in which PDF is rendered.