https://www.redmine.org/https://www.redmine.org/favicon.ico?16793021292011-11-14T15:29:14ZRedmineRedmine - Defect #9055: Version files in Files module cannot be downloaded if issue tracking is disabledhttps://www.redmine.org/issues/9055?journal_id=337402011-11-14T15:29:14ZStanislav Pach
<ul><li><strong>Assignee</strong> set to <i>Azamat Hackimov</i></li><li><strong>% Done</strong> changed from <i>0</i> to <i>10</i></li></ul><p>At first - sorry Azamat to assign you to this ticket, but nobody has reflected to this defect for 3 months so I have assigned you. Please reassign this ticket to proper person.</p>
<p>Regarding this issue - it is still present in release 1.2.2. <br />I have found out more details about this issue. It will raise up just in case when there are following conditions fulfiled:</p>
<p>- a project is marked as "Public" <br />- project has enabled just "Files" in module list (of course there are some files in Files)<br />- to these files in Files part is accessing someone who is not a member of this (sub)project (not listed in "Members" of this project).</p>
<p>Error message in this case is: "404 - The page you were trying to access doesn't exist or has been removed."</p>
<p>If a member of this project is accessing these files , than it`s working fine.</p>
<p>The workaroud is following: If in Modules list is checked also "Issue tracking" (together with Files), than non-member users of this project are allowed to download files without any problems.</p> Redmine - Defect #9055: Version files in Files module cannot be downloaded if issue tracking is disabledhttps://www.redmine.org/issues/9055?journal_id=337982011-11-16T04:53:13ZMischa The Evil
<ul><li><strong>Assignee</strong> deleted (<del><i>Azamat Hackimov</i></del>)</li><li><strong>% Done</strong> changed from <i>10</i> to <i>0</i></li></ul><p>Isn't this the same as <a class="issue tracker-1 status-5 priority-5 priority-high2 closed" title="Defect: Deactivating the issue-tracking module makes project's files, bound to project's versions, inacce... (Closed)" href="https://www.redmine.org/issues/9360">#9360</a>? I think so. Please provide feedback so we can close this issue as a duplicate since <a class="issue tracker-1 status-5 priority-5 priority-high2 closed" title="Defect: Deactivating the issue-tracking module makes project's files, bound to project's versions, inacce... (Closed)" href="https://www.redmine.org/issues/9360">#9360</a> seems better documented.</p> Redmine - Defect #9055: Version files in Files module cannot be downloaded if issue tracking is disabledhttps://www.redmine.org/issues/9055?journal_id=338012011-11-16T07:57:32ZEtienne Massip
<ul></ul><p>And maybe linked to <a class="issue tracker-1 status-5 priority-4 priority-default closed" title="Defect: 403 forbidden on attachments, after upgrade to 1.2.0, 1.2.1 and 1.2.2 (Closed)" href="https://www.redmine.org/issues/9576">#9576</a> too.</p> Redmine - Defect #9055: Version files in Files module cannot be downloaded if issue tracking is disabledhttps://www.redmine.org/issues/9055?journal_id=338042011-11-16T08:27:27ZEtienne Massip
<ul><li><strong>Target version</strong> set to <i>Candidate for next minor release</i></li></ul> Redmine - Defect #9055: Version files in Files module cannot be downloaded if issue tracking is disabledhttps://www.redmine.org/issues/9055?journal_id=338052011-11-16T08:27:39ZEtienne Massip
<ul><li><strong>Status</strong> changed from <i>New</i> to <i>Confirmed</i></li></ul> Redmine - Defect #9055: Version files in Files module cannot be downloaded if issue tracking is disabledhttps://www.redmine.org/issues/9055?journal_id=338062011-11-16T08:28:38ZEtienne Massip
<ul></ul><p>Mischa 's deeper investigation report can be found in <a class="issue tracker-1 status-5 priority-5 priority-high2 closed" title="Defect: Deactivating the issue-tracking module makes project's files, bound to project's versions, inacce... (Closed)" href="https://www.redmine.org/issues/9360">#9360</a> note 5.</p> Redmine - Defect #9055: Version files in Files module cannot be downloaded if issue tracking is disabledhttps://www.redmine.org/issues/9055?journal_id=338072011-11-16T08:30:46ZEtienne Massip
<ul></ul><p>And, BTW, according to <a class="issue tracker-1 status-5 priority-4 priority-default closed" title="Defect: 403 forbidden on attachments, after upgrade to 1.2.0, 1.2.1 and 1.2.2 (Closed)" href="https://www.redmine.org/issues/9576">#9576</a>, it is a regression since it used to work fine in <a class="version" href="https://www.redmine.org/versions/20">1.1.0</a>.</p> Redmine - Defect #9055: Version files in Files module cannot be downloaded if issue tracking is disabledhttps://www.redmine.org/issues/9055?journal_id=338092011-11-16T08:36:52ZStéphane Liabat
<ul></ul><p>Etienne Massip wrote:</p>
<blockquote>
<p>And maybe linked to <a class="issue tracker-1 status-5 priority-4 priority-default closed" title="Defect: 403 forbidden on attachments, after upgrade to 1.2.0, 1.2.1 and 1.2.2 (Closed)" href="https://www.redmine.org/issues/9576">#9576</a> too.</p>
</blockquote>
<p>I confirm.<br />This is a bug of 1.2.0 on existing database. 9576</p> Redmine - Defect #9055: Version files in Files module cannot be downloaded if issue tracking is disabledhttps://www.redmine.org/issues/9055?journal_id=338102011-11-16T08:53:30ZEtienne Massip
<ul></ul><p>Mischa The Evil wrote in <a class="issue tracker-1 status-5 priority-5 priority-high2 closed" title="Defect: Deactivating the issue-tracking module makes project's files, bound to project's versions, inacce... (Closed)" href="https://www.redmine.org/issues/9360">#9360</a>:</p>
<blockquote>
The questions which come up in me are:
<ul>
<li>Why does Redmine do that <code>visible?</code> check?</li>
<li>Where (as in code) is it defined?</li>
</ul>
</blockquote>
<p><code>#AttachmentsController#read_authorize</code> filter (<a class="source" href="https://www.redmine.org/projects/redmine/repository/svn/revisions/7819/entry/trunk/app/controllers/attachments_controller.rb#L78">source:/trunk/app/controllers/attachments_controller.rb@7819#L78</a>) calls <code>Attachment#visible?</code> (<a class="source" href="https://www.redmine.org/projects/redmine/repository/svn/revisions/7819/entry/trunk/app/models/attachment.rb#L117">source:/trunk/app/models/attachment.rb@7819#L117</a>) which itself calls <code>Version#visible?</code>.</p>
I think that the inconstancy is the following:
<ul>
<li>the user needs the IssueTracking module's <code>view_issues</code> permission to get read access to a version (and to its contents)</li>
<li>there is no need to enable IssueTracking module to manage versions</li>
</ul> Redmine - Defect #9055: Version files in Files module cannot be downloaded if issue tracking is disabledhttps://www.redmine.org/issues/9055?journal_id=338912011-11-19T12:24:42ZStanislav Pach
<ul></ul><p>The description of issue <a class="issue tracker-1 status-5 priority-5 priority-high2 closed" title="Defect: Deactivating the issue-tracking module makes project's files, bound to project's versions, inacce... (Closed)" href="https://www.redmine.org/issues/9360">#9360</a> seems to be the same as mine. Except one thing - I don`t have anonymous users so I don`t know the behavior of this issue for them. Issue <a class="issue tracker-1 status-5 priority-4 priority-default closed" title="Defect: 403 forbidden on attachments, after upgrade to 1.2.0, 1.2.1 and 1.2.2 (Closed)" href="https://www.redmine.org/issues/9576">#9576</a> is also very similar, but the description is not so detailed.</p> Redmine - Defect #9055: Version files in Files module cannot be downloaded if issue tracking is disabledhttps://www.redmine.org/issues/9055?journal_id=339832011-11-21T22:56:12ZMischa The Evil
<ul></ul><p>Etienne Massip wrote:</p>
<blockquote>
<p><code>#AttachmentsController#read_authorize</code> filter (<a class="source" href="https://www.redmine.org/projects/redmine/repository/svn/revisions/7819/entry/trunk/app/controllers/attachments_controller.rb#L78">source:/trunk/app/controllers/attachments_controller.rb@7819#L78</a>) calls <code>Attachment#visible?</code> (<a class="source" href="https://www.redmine.org/projects/redmine/repository/svn/revisions/7819/entry/trunk/app/models/attachment.rb#L117">source:/trunk/app/models/attachment.rb@7819#L117</a>) which itself calls <code>Version#visible?</code>.</p>
</blockquote>
<p>Thanks for this educational explanation...</p>
<blockquote>
I think that the inconstancy is the following:
<ul>
<li>the user needs the IssueTracking module's <code>view_issues</code> permission to get read access to a version (and to its contents)</li>
<li>there is no need to enable IssueTracking module to manage versions</li>
</ul>
</blockquote>
<p>I agree.</p> Redmine - Defect #9055: Version files in Files module cannot be downloaded if issue tracking is disabledhttps://www.redmine.org/issues/9055?journal_id=342972011-11-29T19:37:11ZJean-Philippe Langjp_lang@yahoo.fr
<ul><li><strong>Subject</strong> changed from <i>Permissions for files are not respected</i> to <i>Version files in Files module cannot be downloaded if issue tracking is disabled</i></li><li><strong>Status</strong> changed from <i>Confirmed</i> to <i>Resolved</i></li><li><strong>Assignee</strong> set to <i>Jean-Philippe Lang</i></li><li><strong>Target version</strong> changed from <i>Candidate for next minor release</i> to <i>1.2.3</i></li><li><strong>Resolution</strong> set to <i>Fixed</i></li></ul><p>Fixed in <a class="changeset" title="Fixed: version files in Files module cannot be downloaded if issue tracking is disabled (#9055)." href="https://www.redmine.org/projects/redmine/repository/svn/revisions/7984">r7984</a>.</p> Redmine - Defect #9055: Version files in Files module cannot be downloaded if issue tracking is disabledhttps://www.redmine.org/issues/9055?journal_id=343082011-11-29T21:17:56ZJean-Philippe Langjp_lang@yahoo.fr
<ul><li><strong>Status</strong> changed from <i>Resolved</i> to <i>Closed</i></li></ul><p>Merged in <a class="changeset" title="Merged r7983 and r7984 from trunk." href="https://www.redmine.org/projects/redmine/repository/svn/revisions/8000">r8000</a>.</p>