query LegacyAttachmentPolicy permissions against parent resource
Reported by: |
Stephen Compall <stephen.compall@…> |
Owned by: |
stephen.compall@… |
Priority:
|
normal
|
Milestone:
|
0.11.3
|
Component:
|
attachment
|
Version:
|
0.11.2.1
|
Severity:
|
minor
|
Keywords:
|
patch
|
Cc:
|
|
Branch:
|
|
Release Notes:
|
|
API Changes:
|
|
Internal Changes:
|
|
As the idea of LegacyAttachmentPolicy
is to link permission to view, change etc attachments to the permission to view, change etc their containing resources, i.e. tickets, wiki pages, and milestones, the resource queried for permission ought to be that parent resource. For example, as ATTACHMENT_VIEW
maps to TICKET_VIEW
, the TICKET_VIEW
should be checked against the ticket resource.
I rely on this in my installation, because I have fine-grained ticket and wiki access policy.
Change History
(5)
Milestone: |
→ 0.11.4
|
Owner: |
set to Remy Blank
|
Milestone: |
0.11.4 → 0.11.3
|
Resolution: |
→ fixed
|
Status: |
new → closed
|
Owner: |
changed from Remy Blank to stephen.compall@…
|
patch with unit testing