Roundup Tracker - Issues

Issue 2550536

classification
Title: Audit file/message linking/unlinking
Type: security Severity: major
Components: Web interface Versions: 1.4
process
Status: new Resolution:
Dependencies: Superseder:
Assigned To: Nosy List: ajaksu2, ezio.melotti, rouilj
Priority: Keywords: patch

Created on 2009-04-12 23:50 by ajaksu2, last changed 2017-10-26 03:28 by rouilj.

Files
File name Uploaded Description Edit Remove
file_msg_unlink.diff ajaksu2, 2009-04-12 23:53 New auditor, schema and template changes
file_msg_unlink2.diff ajaksu2, 2009-04-13 17:35 Adds the 'linked' check
issue267-2.diff ezio.melotti, 2011-07-25 05:04 Fix applied to the Python bug tracker
Messages
msg3687 Author: [hidden] (ajaksu2) Date: 2009-04-12 23:50
Any user can unlink/link any files or messages from/to any issue.
Attached patch solves spurious unlinking and makes it possible to
restore unlinked files/msgs via the web UI.

However, linking a file or message to many issues is still possible. A
'linked' Boolean attribute could be used to block linking any
already-linked msg/file to another issue, while still allowing e.g. to
move a file from one issue to another.

Any feedback on the current patch or about how to fix the multiple
issues per file/msg problem is most welcome :)
msg3690 Author: [hidden] (ajaksu2) Date: 2009-04-13 17:35
This new version forbids re-linking an already linked file or message to
another issues.
msg4353 Author: [hidden] (ezio.melotti) Date: 2011-07-25 05:04
FWIW the attached patch is the solution currently applied on the
bugs.python.org instance.

See also http://psf.upfronthosting.co.za/roundup/meta/issue267
msg5964 Author: [hidden] (rouilj) Date: 2017-04-24 00:26
Note that this patch changes the tracker and not core code.

Also I have a tracker where I can create a "meta" issue.
I can link other issues (group them) into the meta issue.
By updating the meta issue, the same message is sent to all
the grouped issues.

This is an alternate way of merging multiple issues and treating
them as a single issue.

I am not quite sure but this patch seems to break that use case.

I wonder if it would be better to add this as an example on the wiki
and link to this ticket.

I do like providing a ui for linking/unlinking messages
and providing an undo action for a spurious unlink.

Maybe that should go into the classic tracker.
msg6045 Author: [hidden] (rouilj) Date: 2017-10-26 03:28
One other thing to note:

http://psf.upfronthosting.co.za/roundup/meta/msg1458

reports that unlinking/linking changes the order of display of the 
messages. The message is displayed after linking as the newest
message in the issue. Even though the date stamp is the original
datestamp.

This makes it a bit confusing. Consider opening another ticket
for this problem if it persists after implementing these changes.
History
Date User Action Args
2017-10-26 03:28:56rouiljsetmessages: + msg6045
2017-04-24 00:26:16rouiljsetnosy: + rouilj
messages: + msg5964
2012-10-10 15:46:07adminsetfiles: file_msg_unlink.diff, file_msg_unlink2.diff, issue267-2.diff
2011-07-25 05:04:14ezio.melottisetfiles: + issue267-2.diff
nosy: + ezio.melotti
messages: + msg4353
2009-04-13 17:35:26ajaksu2setfiles: + file_msg_unlink2.diff
messages: + msg3690
2009-04-12 23:53:24ajaksu2setfiles: + file_msg_unlink.diff
keywords: + patch
2009-04-12 23:52:05ajaksu2setfiles: - unlinkauditor.py
2009-04-12 23:50:56ajaksu2create