not checking for local permissions while tring to download a tracker attachment
- Status
- Closed
- Subject
- not checking for local permissions while tring to download a tracker attachment
- Version
- 1.9.x
- Category
- Error
- Feature
- Trackers
- Resolution status
- Fixed or Solved
- Submitted by
- mn
- Volunteered to solve
- mn
- Lastmod by
- Nelson Ko
- Rating
- Description
I made a tracker and get one of the user's group the permission to view this tracker only (by making local permissions only for that tracker).
So users of that group can view that tracker's items but when clicking to download one of the attachments, they only see a blank page.- Solution
koth: it is actually not as simple as below - need to take into account situation of view_pending and view_closed perms. Even with latest fix, still might not work with user/group trackers.
I saw the code of download_item_attachment.php and realized that only global permission are being checked, so I made some changes just after calling
include_once ('lib/trackers/trackerlib.php');changes are:
adding:$query = "SELECT `trackerId` FROM `tiki_tracker_items` WHERE `itemId`=(SELECT `itemId` FROM `tiki_tracker_item_attachments` WHERE `attId`=? LIMIT 1)";
$trackerId = $dbTiki->getOne($query,$_REQUESTattId);
and changing:if ($tiki_p_view_trackers != 'y') {
die;
}to:
if ($tiki_p_view_trackers != 'y' && !($userlib->object_has_permission($user, $trackerId, 'tracker', 'tiki_p_view_trackers')) ) {
die;
}- Importance
- 7
- Priority
- 35
- Demonstrate Bug on Tiki 19+
-
This bug has been demonstrated on show2.tiki.org
Please demonstrate your bug on show2.tiki.org
Show.tiki.org is not configured properlyThe public/private keys configured to connect to show2.tiki.org were not accepted. Please make sure you are using RSA keys. Thanks.
- Demonstrate Bug (older Tiki versions)
-
This bug has been demonstrated on show.tikiwiki.org
Please demonstrate your bug on show.tikiwiki.org
Show.tiki.org is not configured properlyThe public/private keys configured to connect to show.tikiwiki.org were not accepted. Please make sure you are using RSA keys. Thanks.
- Ticket ID
- 1027
- Created
- Wednesday 28 February, 2007 17:51:08 UTC
by Unknown - LastModif
- Monday 18 June, 2007 18:26:11 UTC