Hello everyone,
I noticed that in order to create a link between an Article and a Ticket, the user needs the ModifyArticle permission.
Isn’t there a more specific permission that allows linking Articles to Tickets without granting full ModifyArticle rights?
Even though the Article class has the “link article to ticket” option enabled, RT still requires the ModifyArticle permission. Is this expected behavior, or should there be a more granular permission for this action?
While going through the RT source code, I found in the Article.pm file that changing the permission in the ModifyLinkRight subroutine from ModifyArticle to something else (like ShowClass) allows RT to create the link between the Article and the Ticket.
Our current workaround is to create an Article_Local.pm file redefining that subroutine.
Is there a better or more official way to handle this?
Thanks!