Redmine

To migrate db and restart Rails:

touch tmp/restart.txt;RAILS_ENV=production bundle exec rake db:migrate

I think it's related to:

Feature #9358 - Issue attachment permissions
Feature #4362 - Permissions on attachments
Feature #21562 - Add a permission to prevent user delete issues attachments

To increase the changes to have this patch taken into account, you should add tests to it.

This patch introduces 3 permissions as follows.

• :view_attachments
• :edit_permission
• :delete_attachments

Frederico Camara, thank you for posting this useful patch. Could you add tests?

Go MAEDA wrote:

This patch introduces 3 permissions as follows.

• :view_attachments
• :edit_permission
• :delete_attachments

Frederico Camara, thank you for posting this useful patch. Could you add tests?

I will try to, but I'm somewhat new to Ruby/Rails and I don't know how to make tests. At least the Patch Details on the description lists which tests have to be made. This may take a while.

PS: I said it in the first line of the Description :-)

Go MAEDA wrote:

This patch introduces 3 permissions as follows.

• :view_attachments
• :edit_permission
• :delete_attachments

Frederico Camara, thank you for posting this useful patch. Could you add tests?

I found some problem when I login with LDAP's account(AD),it show "Internal error"；and if use built-in account to login, it can work normal.
my redmine version is below:
Environment:
Redmine version 3.3.1.stable
Ruby version 2.3.1-p112 (2016-04-26) [x86_64-linux]
Rails version 4.2.7.1
Environment production
Database adapter PostgreSQL

James Lai wrote

I found some problem when I login with LDAP's account(AD),it show "Internal error"；and if use built-in account to login, it can work normal.
my redmine version is below:
Environment:
Redmine version 3.3.1.stable
Ruby version 2.3.1-p112 (2016-04-26) [x86_64-linux]
Rails version 4.2.7.1
Environment production
Database adapter PostgreSQL

Could you post the error log for the internal error you are receiving? It could be caused by a plugin, or by a bug in my code, I don't know.

I use ldap login at work, but I think someone implemented some restriction for my development environment. I don't think it can still reach the ldap server, I'll try it later.

Thank you.

Frederico Camara wrote:

James Lai wrote

I found some problem when I login with LDAP's account(AD),it show "Internal error"；and if use built-in account to login, it can work normal.
my redmine version is below:
Environment:
Redmine version 3.3.1.stable
Ruby version 2.3.1-p112 (2016-04-26) [x86_64-linux]
Rails version 4.2.7.1
Environment production
Database adapter PostgreSQL

Could you post the error log for the internal error you are receiving? It could be caused by a plugin, or by a bug in my code, I don't know.

I use ldap login at work, but I think someone implemented some restriction for my development environment. I don't think it can still reach the ldap server, I'll try it later.

Thank you.

I've resolved it now,it is some file's permission(production log and tmp/ldapcatche) cause,now I've resolved it.Thank you.

Hello Frederico,when I patch atta.3.3 throw "patch --dry-run -p1 < atta.3.3",I get the error as below:

checking file app/controllers/issues_controller.rb
Hunk #1 FAILED at 136 (different line endings).
Hunk #2 FAILED at 474 (different line endings).
2 out of 2 hunks FAILED
checking file app/models/issue.rb
Hunk #1 FAILED at 43 (different line endings).
Hunk #2 FAILED at 265 (different line endings).
2 out of 2 hunks FAILED
checking file app/models/journal.rb
Hunk #1 FAILED at 74 (different line endings).
1 out of 1 hunk FAILED

So I have to change it by manual.

James Lai wrote:

Hello Frederico,when I patch atta.3.3 throw "patch --dry-run -p1 < atta.3.3",I get the error as below:

checking file app/controllers/issues_controller.rb
Hunk #1 FAILED at 136 (different line endings).
Hunk #2 FAILED at 474 (different line endings).
2 out of 2 hunks FAILED
checking file app/models/issue.rb
Hunk #1 FAILED at 43 (different line endings).
Hunk #2 FAILED at 265 (different line endings).
2 out of 2 hunks FAILED
checking file app/models/journal.rb
Hunk #1 FAILED at 74 (different line endings).
1 out of 1 hunk FAILED

So I have to change it by manual.

You probably use Windows. Windows and Linux use different characters for line endings. Unless you use an editor that respects that, you can unknowingly change the end of line characters of thefiles or on the patch file, and patch will fail. Maybe you'll have to sed end of line characters or use unix2dos/dos2unix.

Tip: Google for "patch different line endings".

Hello, Frederico,
I have test again, using centos7（CentOS Linux release 7.3.1611 (Core)） and redmine 3.3.2 version,in redmine path I run "patch --dry-run -p1 < atta.3.3" ,the same error appear.

James Lai wrote:

Hello, Frederico,
I have test again, using centos7（CentOS Linux release 7.3.1611 (Core)） and redmine 3.3.2 version,in redmine path I run "patch --dry-run -p1 < atta.3.3" ,the same error appear.

Maybe there's something different with the redmine package you're using. Try this: on Redmine directory, issue these two commands:

cat -et atta.3.3 | head
cat -et app/models/journal.rb | head

cat -et exposes the end of line characters, head shows only the beginning on the file.You should see some difference at the end of each line between the two files. If you do, my guess is you're using redmine packaged using windows. I installed Redmine using git, but I know Redmine community uses something else. The end of line character does not make any difference for Ruby, but it does for patch.

You can probably solve it using dos2unix:

find . -type f -exec dos2unix {} \;

Patch should work then.

Hello, Frederico,
Thank you very much,now I use redmine-3.3.2.tar.gz to installed and patch success.

Frederico Camara wrote:

Go MAEDA wrote:

This patch introduces 3 permissions as follows.

• :view_attachments
• :edit_permission
• :delete_attachments

Frederico Camara, thank you for posting this useful patch. Could you add tests?

I will try to, but I'm somewhat new to Ruby/Rails and I don't know how to make tests.

You can see examples.
source:trunk/test

Good patch, thank you very much!
Works with redmine-3.3 stable and LDAP fine.

Ilya Ternovoy wrote:

I rebooted the server and now attachments settings are available on "role and permissions" page. But checkbox "Delete attachments" has no effect. I mean even if i uncheck it the user can delete an attachment anyway. Should I uncheck any other checkboxes to forbid user delete attachment? Current permission screen in attachment

Patch works great!) It seems like I have attachment delete button because I am admin, in spite of my role on project. Users who are not admins do not see delete button now! Thanks!

Ilya Ternovoy wrote:

Ilya Ternovoy wrote:

I rebooted the server and now attachments settings are available on "role and permissions" page. But checkbox "Delete attachments" has no effect. I mean even if i uncheck it the user can delete an attachment anyway. Should I uncheck any other checkboxes to forbid user delete attachment? Current permission screen in attachment

Patch works great!) It seems like I have attachment delete button because I am admin, in spite of my role on project. Users who are not admins do not see delete button now! Thanks!

You're welcome.

Admins are so powerful, I am usually logged as a normal user in a normal browser window, and as admin in a separate private browser window.

Hello,Frederico
your patch is very usefully,and I think that how to realize the document module's attachment upload permission,are you any idea? thank you!

James Lai wrote:

Hello,Frederico
your patch is very usefully,and I think that how to realize the document module's attachment upload permission,are you any idea? thank you!

The redmine Documents module has its own permissions. They are grouped under Documents in Administration > Roles and Permissions.

Frederico Camara wrote:

James Lai wrote:

Hello,Frederico
your patch is very usefully,and I think that how to realize the document module's attachment upload permission,are you any idea? thank you!

The redmine Documents module has its own permissions. They are grouped under Documents in Administration > Roles and Permissions.

I mean is I can control user to upload attachment permission.give an example,developer or reporter can add document,but can not upload attechments,only manager can add document and upload attachments.

Frederico Camara wrote:

James Lai wrote:

Frederico Camara wrote:

James Lai wrote:

Hello,Frederico
your patch is very usefully,and I think that how to realize the document module's attachment upload permission,are you any idea? thank you!

The redmine Documents module has its own permissions. They are grouped under Documents in Administration > Roles and Permissions.

I mean is I can control user to upload attachment permission.give an example,developer or reporter can add document,but can not upload attechments,only manager can add document and upload attachments.

I don't think I understand what you're trying to say. What I meant is that permissions for Documents are independent of permissions for Issue attachments. See the edited screencapture I made "Issue Permissions" (attached).

thank you very much.

+1 IMHO, this should be added to Redmine core.

Frederico Camara wrote:

Nothing Ctrl wrote:

Hello,

Can you update for Redmine 3.4

I'm test with file atta.3.3 and atta.master but dry-run got some failed.

Updated, to 3.4-stable (on github).
Not tested, but it should work, just had to adapt to little changes since 3.3.

Confirm is work on Redmine 3.4

So for Redmine 4, we should only run this one 0015-Implement... from above post?

How about Redmine 4.1 ?

Aleksandar Pavic wrote:

So for Redmine 4, we should only run this one 0015-Implement... from above post?

How about Redmine 4.1 ?

Untested, but probably works. Redmine 4 changed some user permissions regarding issues, you can see it in the role administration.

I did not try patching Redmine 4.1. Tell me if patch fails.

Well I downloaded fresh 4.1 and got few chunk errors, and many succeeds...

patch --dry-run -p1 < 0015-Implements-permissions-and-restrictions-to-issue-att.patch 
patching file app/controllers/issues_controller.rb
Hunk #1 succeeded at 88 with fuzz 2 (offset 2 lines).
Hunk #2 succeeded at 130 (offset 3 lines).
Hunk #3 succeeded at 169 (offset 3 lines).
Hunk #4 succeeded at 287 with fuzz 2 (offset 18 lines).
Hunk #5 succeeded at 353 (offset 21 lines).
Hunk #6 succeeded at 574 (offset 23 lines).
patching file app/models/issue.rb
Hunk #1 succeeded at 40 (offset 2 lines).
Hunk #2 succeeded at 189 with fuzz 1 (offset 5 lines).
Hunk #3 succeeded at 296 (offset 5 lines).
Hunk #4 succeeded at 1657 (offset 7 lines).
patching file app/models/journal.rb
Hunk #1 succeeded at 92 (offset 4 lines).
patching file app/models/mailer.rb
Hunk #1 succeeded at 99 with fuzz 1 (offset 6 lines).
Hunk #2 succeeded at 117 (offset 7 lines).
Hunk #3 succeeded at 133 (offset 7 lines).
patching file app/views/issues/_edit.html.erb
Hunk #1 succeeded at 45 (offset 5 lines).
Hunk #2 FAILED at 81.
1 out of 2 hunks FAILED -- saving rejects to file app/views/issues/_edit.html.erb.rej
patching file app/views/issues/index.api.rsb
patching file app/views/issues/new.html.erb
patching file app/views/issues/new.js.erb
patching file app/views/issues/show.api.rsb
patching file app/views/issues/show.html.erb
patching file app/views/mailer/_issue.html.erb
patching file app/views/mailer/_issue.text.erb
patching file app/views/roles/_form.html.erb
Hunk #1 FAILED at 67.
1 out of 1 hunk FAILED -- saving rejects to file app/views/roles/_form.html.erb.rej
patching file config/locales/en.yml
Hunk #1 succeeded at 509 (offset 17 lines).
patching file config/locales/pt-BR.yml
Hunk #1 succeeded at 785 (offset 3 lines).
patching file db/migrate/20161215142110_add_attachments_permissions.rb
patching file lib/plugins/acts_as_searchable/lib/acts_as_searchable.rb
Hunk #1 succeeded at 136 (offset 2 lines).
patching file lib/redmine.rb
Hunk #1 FAILED at 99.
1 out of 1 hunk FAILED -- saving rejects to file lib/redmine.rb.rej
patching file lib/redmine/export/pdf/issues_pdf_helper.rb
Reversed (or previously applied) patch detected!  Assume -R? [n] 

FREDERICO LÚCIO DE SOUZA, can you create this patch as a plugin?

Pawel Orzechowski wrote:

FREDERICO LÚCIO DE SOUZA, can you create this patch as a plugin?

I can take some time. It would have to be implemented differently, I'll try.

Frederico Camara wrote:

Aleksandar Pavic wrote:

Well I downloaded fresh 4.1 and got few chunk errors, and many succeeds...

[...]
So I'm aborting...

There were some minor modifications on some files. Redmine 4.1 patch added.

Hi,
thank you for this implementation. It is great!!!
Does this version works also with Redmine 4.0.3? Or should I use older version?

I've installed the 4.0 version, but, when I create a new issue it follows the rules created. During a modification (with all the attachment rules unflagged) I see again the file button.

Frederico Camara wrote:

Frederico Camara wrote:

Adriano Bellia wrote:

I've installed the 4.0 version, but, when I create a new issue it follows the rules created. During a modification (with all the attachment rules unflagged) I see again the file button.

You're right. I had it implemented on my 3.2 patch but forgot this bit when reimplementing the whole thing to the 4.0, 4.1 patches.

Fix files added.

Sloppy patch. Here is a much better patch, it takes into consideration the user may change the Issue Tracker when showing the attachment button. Also fix a bug when editing the path "/issues/#/edit".

Wish I could delete old files.

Sorry to bother you,
how do I apply this fix? I should first reverse the old patch?
If I try to apply directly 0015-Implements-permissions-and-restrictions-to-issue-att-fix2-4.0.patch after 0015-Implements-permissions-and-restrictions-to-issue-att.patch it asks me to reverse the older one.

Reversed (or previously applied) patch detected! Assume -R? [n] n
Apply anyway? [n] y
Hunk #1 FAILED at 86.
Hunk #2 FAILED at 126.
Hunk #3 succeeded at 158 (offset 3 lines).
Hunk #4 FAILED at 164.
Hunk #5 FAILED at 265.
Hunk #6 FAILED at 328.
Hunk #7 FAILED at 546.
6 out of 7 hunks FAILED

also reversing the first patch and applying directly the fix2 gives errrors :(
If I apply fix1 (after the first patch reverted) it goes perfectly. But If I retry then with the fix2 it gives me the same messages

Thank you!!! Now it seems perfect :)

My question is why this feature is not implemented as plugin?

Pawel Orzechowski wrote:

My question is why this feature is not implemented as plugin?

You have asked me that a month ago, and I answered already (see comment #24623-40).

Implementing as a plugin is much harder, and different. It would have to account that the scope of this feature changed a lot between Redmine versions 3.x and 4.x. See the admin role configuration. On unpatched Redmine, file CRUD restrictions are the same as issue restrictions. Redmine 4 implements permission per tracker, so file restrictions had to be implemented per tracker also.

Besides that, most things were implemented in the controller. I would have to implement them in the model and I would have to research how to do it seamlessly, because Issue.attachments returns ActiveRecord::Associations::CollectionProxy and I would have to test an active record that filters out attachments not visible to the user, for example.

Besides that, implementing as a plugin gives only minor compatibility between versions of Redmine.

This is really sad that we do not have permissions for attachments in redmine. Our company wants to pay for finishing this patch work and pushing it upstream: https://www.redmine.org/boards/5/topics/67335

Frederico, is it possible to update this patch for redmine 6?

Peter Volkov wrote in #note-52:

Frederico, is it possible to update this patch for redmine 6?

I updated it, but I'm not using Redmine 6.0 at work.

I made some random tests, and it appears to be working. If you use it in production, it's a good idea to backup your files directory first.