TICKET_APPEND does not allow adding attachments to tickets

[jakob.gruber@…]

Hi,

I have a Trac setup where anonymous users have TICKET_CREATE and TICKET_APPEND permissions. With this setup, adding attachments should be possible, but the following line generates a redirect to an error page before adding attachments is possible. If the user additionally has TICKET_VIEW permissions, adding attachments works.

I'm not sure exactly why the line exists, since permissions seem to be checked fine without it? Maybe someone more knowledgable can help me out..

Removing the line as below results in the expected behavior (TICKET_APPEND allows adding attachments).

--- web_ui.py   2009-11-23 15:27:54.000000000 +0100
+++ web_ui.py.new       2009-11-23 15:43:37.000000000 +0100
@@ -980,7 +980,6 @@

     def _do_create(self, req, ticket):
         ticket.insert()
-        req.perm(ticket.resource).require('TICKET_VIEW')

         # Notify
         try:

[jakob.gruber@…]

To summarize, in

web_ui.py
in _do_create

req.perm(ticket.resource).require('TICKET_VIEW') 

is called before

if 'attachment' in req.args:
             req.redirect(req.href.attachment('ticket', ticket.id,
                                              action='new'))

which AFAIK should NOT require TICKET_VIEW permissions.

[jakob.gruber@…]

Yet another comment (sorry) - this seems to have been fixed in trunk in r7579 (and then improved in r8675) but it doesn't appear to be in 0.11.6rc1.

Any chance of pushing this minor fix into 0.11.6?

[Christian Boos]

Eventually r7579, which can be applied as such, but not r8675.

What do others think?

[Remy Blank]

+1 for [7579].

[Christian Boos]

Done in [8856].