[patch] Additional fine-grained permission checks in trac.ticket.web_ui

[ebray <hyugaricdeau@…>]

There are a few places in trac.ticket.web_ui in which the ticket resource is not passed to req.perm. This sometimes leads to a problem in my custom permission policy when a user has, for example, TICKET_CHGPROP for a specific ticket, but not for all tickets.

Hopefully this patch doesn't cause any problems.

[ebray <hyugaricdeau@…>]

Adds fine-grained permission checks in a few additional places.

[Christian Boos]

Thanks for the patch, applied in [6905].

[ebray <hyugaricdeau@…>]

Is there a reason you're reopening this ticket? If so, give it. Otherwise, this is fixed.

[ebray <hyugaricdeau@…>]

Actually, I'm going to reopen this ticket now, because there's one other problem that's somewhat related, but small enough that I don't think it warrants a separate ticket.

This actually caused an exception to be raised prior to r6905: On lines 838 and 847 of trac.ticket.web_ui are the line ticket.values = ticket._old. But this leads to problems down the line since ticket._old only contains values for the fields that were changed. To revert the values, it should be ticket.values.update(ticket._old).

[Christian Boos]

Ok.

[Christian Boos]

Applied suggested change in [6907].