RT::Ticket::SetOwner() permissions model?

Hello!

While looking at that last bit, I re-read the logic in
RT::ticket::SetOwner() and was a bit confused, so I sought
understanding. Originally, I had a really long email here, but it
seemed to benefit from some wiki formatting, so I put it there
instead:

http://wiki.bestpractical.com/?TicketOwnershipPermissions

The gist is: we should refactor the conditionals at the top of
SetOwner() to be more clear and directly correspond to the various
ownership rights in the ACL and I have a suggestion how, complete with
code.

If there’s interest I’ll produce an actual patch. =]

Cheers!

–j
Jim Meyer, Geek at Large purp@acm.org

At Monday 4/10/2006 03:00 PM, Jim Meyer wrote:

Hello!

While looking at that last bit, I re-read the logic in
RT::ticket::SetOwner() and was a bit confused, so I sought
understanding. Originally, I had a really long email here, but it
seemed to benefit from some wiki formatting, so I put it there
instead:

http://wiki.bestpractical.com/?TicketOwnershipPermissions

The gist is: we should refactor the conditionals at the top of
SetOwner() to be more clear and directly correspond to the various
ownership rights in the ACL and I have a suggestion how, complete with
code.

Hi Jim,

What version of RT is this based on? I’m not seeing a GiveTicket
right anywhere in 3.4.2. Also in my version, this code is in
Ticket_Overlay - I’m assuming you’re on a later version?

The logic you suggest looks cleaner, but it doesn’t take the type of
action ($Type) into consideration. This has always thrown me a
little, because the ability to do a particular action is not entirely
dependent on the ACLs.

Steve