Message1558
Roundup version: 0.8.0 b1
Backend: anydbm (with sqlite it is the same
situation)
Template: classic
Probably caused by this checkin: http://xrl.us/ebuo
I found the folowing problem with displaying issues:
When we take away "Edit Issue" and "Create Issue"
permissions
from user, then the individual issues cannot be
displayed.
If you try to acces it, no matter if following the link
from
the issue index page, or via entering the url by hand,
this is what happens:
1. Message "You are not allowed to edit items of
class issue"
is displayed.
2. Page template changes to issue.index.
I checked the code, and found out the following:
- Template issue.item.html is being rendered.
- On the first occurence of "context.title.field()" a
security exception is thrown.
This is in StringHTMLProperty.field() method - in
the first
line it calls self.edit_check(), and has no chance to
continue
unless the user has 'Edit' permission.
So the "return self.plain()" at the end of field()
method
is not reachable.
So this looks to me like a bug. I would expect the
page
displayed read-only, and not the "You are not
allowed..." message.
And point 2 - it is yet acceptable for issues,
but for example if you disable editing of "keyword"
and then try to access:
"http://localhost:8080/some_tracker/keyword1"
then you end up like before on the issue index page,
and the only difference is the message:
"You are not allowed to edit items of class
keyword"
Cheers,
--
Maciek |
|
Date |
User |
Action |
Args |
2009-02-03 14:21:03 | admin | link | issue1082755 messages |
2009-02-03 14:21:03 | admin | create | |
|