Roundup Tracker - Issues

Message1558

Author mstarzyk
Recipients
Date 2004-12-10.08:35:37
Message-id
In-reply-to
Roundup version: 0.8.0 b1
Backend: anydbm (with sqlite it is the same 
situation)
Template: classic
Probably caused by this checkin: http://xrl.us/ebuo

I found the folowing problem with displaying issues:
When we take away "Edit Issue" and "Create Issue" 
permissions 
from user, then the individual issues cannot be 
displayed.

If you try to acces it, no matter if following the link 
from 
the issue index page, or via entering the url by hand, 
this is what happens:

1. Message "You are not allowed to edit items of 
class issue"
   is displayed.
2. Page template changes to issue.index. 

I checked the code, and found out the following:
- Template issue.item.html is being rendered.
- On the first occurence of "context.title.field()" a 
  security exception is thrown. 
  This is in StringHTMLProperty.field() method - in 
the first 
  line it calls self.edit_check(), and has no chance to 
continue 
  unless the user has 'Edit' permission. 
  So the "return self.plain()" at the end of field() 
method
  is not reachable.
So this looks to me like a bug. I would expect the 
page 
displayed read-only, and not the "You are not 
allowed..." message.

And point 2 - it is yet acceptable for issues, 
but for example if you disable editing of "keyword"
and then try to access:
    "http://localhost:8080/some_tracker/keyword1" 
then you end up like before on the issue index page,
and the only difference is the message:
   "You are not allowed to edit items of class 
keyword"

Cheers, 
--
Maciek
History
Date User Action Args
2009-02-03 14:21:03adminlinkissue1082755 messages
2009-02-03 14:21:03admincreate