Changeset View still shows code even if fileview permission is disallowed

[halkeye@…]

When you view a changeset, even without the FILE_VIEW permission, you can still view the changes.

[halkeye@…]

patch to fix this

[cmlenz]

If you don't want someone to see your files, you'll have to deny them CHANGESET_VIEW permissions. Does viewing changesets make sense when you're not allowed to see the source?

[Arthaey]

I actually would like to allow some users to see my changesets without seeing the source. I want them to see that I'm working on things, without them being able to see the text of the files I'm working on.

[cboos]

Makes sense. I'd be OK for the above patch. Others?

[cmlenz]

FYI, a user can set the context of the diff to "*" or "all" and will see the complete text of any modified file.

Anyway, I can understand not providing the ZIP download when the user doesn't have FILE_VIEW permissions (because the ZIP will contain the complete files), but also removing the plain diff download doesn't make sense to me.

[cboos]

The reasoning was that if the user doesn't have FILE_VIEW permissions,
he shouldn't be able to see any file content at all, even fragments of
them, by the way of diffs. See also #2671, marked as duplicate.

[cmlenz]

But the only thing the patch does is remove the diff and ZIP export options, or am I missing something? If the user shouldn't see any file contents, we also need to remove the diffs from the generated HTML.

[cboos]

Ah, the patch wasn't by me, and sure, it's not complete.
I'll post a more complete patch later this evening (after lunch ;) ).

[cboos]

Here's a more complete patch, which also hides the diffs from the HTML view if the user doesn't have the FILE_VIEW permission, and even the list of changed files if the user doesn't have the BROWSER_VIEW permission.

[cboos]

new patch uploaded

[cboos]

Patch applied in r3384.