Opened 19 years ago
Closed 19 years ago
#2268 closed defect (fixed)
Changeset View still shows code even if fileview permission is disallowed
| Reported by: | Owned by: | Christian Boos | |
|---|---|---|---|
| Priority: | normal | Milestone: | 0.10 |
| Component: | version control/changeset view | Version: | 0.8.4 |
| Severity: | normal | Keywords: | permissions review |
| Cc: | Branch: | ||
| Release Notes: | |||
| API Changes: | |||
| Internal Changes: | |||
Description
When you view a changeset, even without the FILE_VIEW permission, you can still view the changes.
Attachments (2)
Change History (11)
by , 19 years ago
| Attachment: | TRAC.changeset.patch.txt added |
|---|
comment:1 by , 19 years ago
If you don't want someone to see your files, you'll have to deny them CHANGESET_VIEW permissions. Does viewing changesets make sense when you're not allowed to see the source?
comment:2 by , 19 years ago
I actually would like to allow some users to see my changesets without seeing the source. I want them to see that I'm working on things, without them being able to see the text of the files I'm working on.
comment:3 by , 19 years ago
| Keywords: | permissions added |
|---|---|
| Milestone: | → 0.10 |
| Owner: | changed from to |
| Status: | new → assigned |
Makes sense. I'd be OK for the above patch. Others?
comment:4 by , 19 years ago
FYI, a user can set the context of the diff to "*" or "all" and will see the complete text of any modified file.
Anyway, I can understand not providing the ZIP download when the user doesn't have FILE_VIEW permissions (because the ZIP will contain the complete files), but also removing the plain diff download doesn't make sense to me.
comment:5 by , 19 years ago
The reasoning was that if the user doesn't have FILE_VIEW permissions, he shouldn't be able to see any file content at all, even fragments of them, by the way of diffs. See also #2671, marked as duplicate.
comment:6 by , 19 years ago
But the only thing the patch does is remove the diff and ZIP export options, or am I missing something? If the user shouldn't see any file contents, we also need to remove the diffs from the generated HTML.
comment:7 by , 19 years ago
Ah, the patch wasn't by me, and sure, it's not complete. I'll post a more complete patch later this evening (after lunch ;) ).
by , 19 years ago
| Attachment: | changeset_without_diffs-r3370.patch added |
|---|
Here's a more complete patch, which also hides the diffs from the HTML view if the user doesn't have the FILE_VIEW permission, and even the list of changed files if the user doesn't have the BROWSER_VIEW permission.
patch to fix this