Links to tickets without ShowTicket right displays owner

Loos_Christian · February 5, 2014, 11:13am

Hi,

if you have ticket 1 which is linked to ticket 2 and the user doesn’t
have rights for ticket 2 the link is:
1: [] (owner ticket 2)
The ticket 2 subject and status isn’t displayed because the rights check
but the ticket 2 owner is displayed without any rights check.

Also, if ticket 2 status is closed the class of the span element of the
link isn’t set to ‘ticket-inactive’ because the ticket 2 status value
isn’t accessible for the user.

As a fix I would suggest adding an CurrentUserHasRight(‘ShowTicket’)
check here:

github.com

bestpractical/rt/blob/stable/share/html/Elements/ShowLink#L49


      
          %# derivatives to this work, or any other work intended for use with
          %# Request Tracker, to Best Practical Solutions, LLC, you confirm that
          %# you are the copyright holder for those contributions and you grant
          %# Best Practical Solutions,  LLC a nonexclusive, worldwide, irrevocable,
          %# royalty-free, perpetual, license to use, copy, create derivative
          %# works based on those contributions, and sublicense and distribute
          %# those contributions and any derivatives thereof.
          %#
          %# END BPS TAGGED BLOCK }}}
          % my $member = $URI->Object;
          % if (blessed($member) and $member->isa("RT::Ticket") and $member->CurrentUserHasRight('ShowTicket')) {
          % my $class = $member->QueueObj->IsInactiveStatus($member->Status)
          %     ? 'ticket-inactive'
          %     : 'ticket-active';
          % $class .= ' '.CSSClass($member->Status);
          
          
<span class="<% $class %>">
          <a href="<% $href %>"><%$member->Id%>: <%$member->Subject || ''%> [<% loc($member->Status) %>]</a> (<& /Elements/ShowUser, User => $member->OwnerObj &>)
          </span>
          
          
% } else {

With this, the link would fall back to $URI->AsString which shows only
the ticket id (the subject isn’t shown in this case).

If this fix would be accepted, I have already an pull request open on
this file and maybe I can add an commit with this change to the PR:

or should I create a new PR?

Chris

Kevin_Falcone · February 5, 2014, 3:42pm

If this fix would be accepted, I have already an pull request open on
this file and maybe I can add an commit with this change to the PR:
add the ticket status to the link class by netsandbox · Pull Request #85 · bestpractical/rt · GitHub
or should I create a new PR?

From your description, your fix sounds correct (I’ve not read all the
relevant code to confirm, but I trust that you’re giving a fair
summary).

Please open a separate PR about it since it’s not really related to
85.

-kevin

Kevin_Falcone · February 11, 2014, 7:14pm

Am 05.02.2014 18:00, schrieb rt-devel-request@lists.bestpractical.com:

From your description, your fix sounds correct (I’ve not read all the
relevant code to confirm, but I trust that you’re giving a fair
summary).

Please open a separate PR about it since it’s not really related to
85.

Should this PR should go against maint which will then be merged in
stable or should I create for each branch separate PR’s?

If something is broken in 4.0 (maint) it should go against that and
we’ll merge it up. Sometimes we may rebase something and say it’s
only going into stable if we think it’s not 4.0-relevant.

There are exceptions to this, such as my two recent branches,
4.0/simplesearch-placeholder-text and 4.2/simplesearch-placeholder-text
where the code path is so different between 4.0 and 4.2 that I wrote
two branches.

If something will merge with no or minor tweaking from maint to
stable, then target your branch to maint.

-kevin