Project

General

Profile

Actions
Copy link

Defect #35634

closed

Attachments deletable even though issue edit not permitted

Added by D G over 3 years ago. Updated over 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Marius BĂLTEANU
Category:
Permissions and roles
Target version:
4.1.5
Start date:
Due date:
% Done:

0%

Estimated time:
Resolution:
Fixed
Affected version:
4.2.1

Description

If role A has permission to edit issues in tracker X but not in tracker Y, members of this role can delete attachments in issues with tracker Y.

This commit fixes this for attachments_editable? r15476. Likewise this should be done in /app/models/issue.rb:

  # Overrides Redmine::Acts::Attachable::InstanceMethods#attachments_deletable?
  def attachments_deletable?(user=User.current)
    attributes_editable?(user)
  end

Files

Download all files
0002-Fixed-attachments-deletable-by-user-without-edit-per.patch (2.62 KB) 0002-Fixed-attachments-deletable-by-user-without-edit-per.patch Marius BĂLTEANU, 2021-08-01 13:32
0001-Adds-tests-for-issue-attachment-edit-by-user-without.patch (2.07 KB) 0001-Adds-tests-for-issue-attachment-edit-by-user-without.patch Marius BĂLTEANU, 2021-08-01 13:32
Actions
Copy link

Also available in: Atom PDF