trac-post-commit-hook allows users to fix tickets who do not have the TICKET_MODIFY permission

[schveiguy@…]

If I remove the MODIFY_TICKET permission from the authenticated user, and only add it to selective users, the users that do not have the permission added cannot modify or close a ticket.

However, if a user who does not have permission to modify tickets checks in a file with a comment to fix or reference a ticket, the post-commit hook still makes the change.

I marked the priority as low because it's probably not very common for someone to be able to check in files but not be able to modify tickets. I just noticed it as an inconsistency.

[Christian Boos]

Looks like we still don't do that in source:sandbox/multirepos/tracopt/ticket/commit_updater.py.

(0.12-multirepos for classification, but we can as well do that on trunk, or even later)

[Remy Blank]

I'll fix that. Should we also not add a comment if the user doesn't have TICKET_APPEND?

[schveiguy@…]

Hm.. I would expect that anyone having TICKET_MODIFY permission has TICKET_APPEND permission. It's one of those things where you want to present 3 states with 2 booleans…

I would think that not adding a comment if the user doesn't have TICKET_APPEND can be ok for completeness, but isn't necessary IMO.

But one thing that probably is important is you should be able to have a checkin add a comment to a ticket via the hook if you have the TICKET_APPEND but don't have TICKET_MODIFY.

[Remy Blank]

Fixed in [8955]. Changing the ticket status now requires TICKET_MODIFY. No check for TICKET_APPEND, though.