Issue 1082755
Created on 2004-12-10 08:35 by mstarzyk, last changed 2005-01-04 00:50 by richard.
msg1558 |
Author: [hidden] (mstarzyk) |
Date: 2004-12-10 08:35 |
|
Roundup version: 0.8.0 b1
Backend: anydbm (with sqlite it is the same
situation)
Template: classic
Probably caused by this checkin: http://xrl.us/ebuo
I found the folowing problem with displaying issues:
When we take away "Edit Issue" and "Create Issue"
permissions
from user, then the individual issues cannot be
displayed.
If you try to acces it, no matter if following the link
from
the issue index page, or via entering the url by hand,
this is what happens:
1. Message "You are not allowed to edit items of
class issue"
is displayed.
2. Page template changes to issue.index.
I checked the code, and found out the following:
- Template issue.item.html is being rendered.
- On the first occurence of "context.title.field()" a
security exception is thrown.
This is in StringHTMLProperty.field() method - in
the first
line it calls self.edit_check(), and has no chance to
continue
unless the user has 'Edit' permission.
So the "return self.plain()" at the end of field()
method
is not reachable.
So this looks to me like a bug. I would expect the
page
displayed read-only, and not the "You are not
allowed..." message.
And point 2 - it is yet acceptable for issues,
but for example if you disable editing of "keyword"
and then try to access:
"http://localhost:8080/some_tracker/keyword1"
then you end up like before on the issue index page,
and the only difference is the message:
"You are not allowed to edit items of class
keyword"
Cheers,
--
Maciek
|
msg1559 |
Author: [hidden] (anonymous) |
Date: 2004-12-28 16:32 |
|
Logged In: NO
I am using roundup 0.8b1 on XP and found the same problem.
My users are also unable to see their details. I think that this
is due to the same bug.
|
msg1560 |
Author: [hidden] (richard) |
Date: 2005-01-04 00:50 |
|
Logged In: YES
user_id=6405
Fixed.
The user editing problem was a separate one - please edit your tracker's
schema.py file to change the "View Self" and "Edit Self" permission
names to just "View" and "Edit" as described in the upgrading doc.
|
|
Date |
User |
Action |
Args |
2004-12-10 08:35:37 | mstarzyk | create | |
|