Mailing List Archive: links to tickets without ShowTicket right displays owner

links to tickets without ShowTicket right displays owner

Feb 5, 2014, 3:13 AM

Post #1 of 3 (757 views)

Hi,

if you have ticket 1 which is linked to ticket 2 and the user doesn't
have rights for ticket 2 the link is:
1: [] (owner ticket 2)
The ticket 2 subject and status isn't displayed because the rights check
but the ticket 2 owner is displayed without any rights check.

Also, if ticket 2 status is closed the class of the span element of the
link isn't set to 'ticket-inactive' because the ticket 2 status value
isn't accessible for the user.

As a fix I would suggest adding an CurrentUserHasRight('ShowTicket')
check here:
https://github.com/bestpractical/rt/blob/stable/share/html/Elements/ShowLink#L49
With this, the link would fall back to $URI->AsString which shows only
the ticket id (the subject isn't shown in this case).

If this fix would be accepted, I have already an pull request open on
this file and maybe I can add an commit with this change to the PR:
https://github.com/bestpractical/rt/pull/85
or should I create a new PR?

Chris

Re: links to tickets without ShowTicket right displays owner [ In reply to ]

falcone at bestpractical

Feb 5, 2014, 7:42 AM

Post #2 of 3 (719 views)

Permalink

On Wed, Feb 05, 2014 at 12:13:30PM +0100, Christian Loos wrote:
> If this fix would be accepted, I have already an pull request open on
> this file and maybe I can add an commit with this change to the PR:
> https://github.com/bestpractical/rt/pull/85
> or should I create a new PR?

From your description, your fix sounds correct (I've not read all the
relevant code to confirm, but I trust that you're giving a fair
summary).

Please open a separate PR about it since it's not really related to
85.

-kevin

Re: links to tickets without ShowTicket right displays owner [ In reply to ]

falcone at bestpractical

Feb 11, 2014, 11:14 AM

Post #3 of 3 (711 views)

Permalink

On Tue, Feb 11, 2014 at 09:15:36AM +0100, Christian Loos wrote:
> Am 05.02.2014 18:00, schrieb rt-devel-request@lists.bestpractical.com:
> > From your description, your fix sounds correct (I've not read all the
> > relevant code to confirm, but I trust that you're giving a fair
> > summary).
> >
> > Please open a separate PR about it since it's not really related to
> > 85.
>
> Should this PR should go against maint which will then be merged in
> stable or should I create for each branch separate PR's?

If something is broken in 4.0 (maint) it should go against that and
we'll merge it up. Sometimes we may rebase something and say it's
only going into stable if we think it's not 4.0-relevant.

There are exceptions to this, such as my two recent branches,
4.0/simplesearch-placeholder-text and 4.2/simplesearch-placeholder-text
where the code path is so different between 4.0 and 4.2 that I wrote
two branches.

If something will merge with no or minor tweaking from maint to
stable, then target your branch to maint.

-kevin