Project

General

Profile

Actions

Defect #13287

closed

Non-member role with 'created by or assigned' issue visibility can't view own issues in private project

Added by Daniel Black about 11 years ago. Updated about 11 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Category:
Issues permissions
Target version:
-
Start date:
Due date:
% Done:

0%

Estimated time:
Resolution:
Invalid
Affected version:

Description

About your application's environment
Ruby version 1.9.3 (x86_64-linux)
RubyGems version 1.8.25
Rack version 1.4
Rails version 3.2.12
Active Record version 3.2.12
Action Pack version 3.2.12
Active Resource version 3.2.12
Action Mailer version 3.2.12
Active Support version 3.2.12
Middleware Rack::Cache, ActionDispatch::Static, Rack::Lock, #<ActiveSupport::Cache::Strategy::LocalCache::Middleware:0x000000027f4778>, Rack::Runtime, Rack::MethodOverride, ActionDispatch::RequestId, Rails::Rack::Logger, ActionDispatch::ShowExceptions, ActionDispatch::DebugExceptions, ActionDispatch::RemoteIp, ActionDispatch::Callbacks, ActiveRecord::ConnectionAdapters::ConnectionManagement, ActiveRecord::QueryCache, ActionDispatch::Cookies, ActionDispatch::Session::CookieStore, ActionDispatch::Flash, ActionDispatch::ParamsParser, ActionDispatch::Head, Rack::ConditionalGet, Rack::ETag, ActionDispatch::BestStandardsSupport, OpenIdAuthentication
Application root /usr/local/redmine-new/redmine-2.2
Environment production
Database adapter mysql2
Database schema version 20130217094251

version: r11458

I used rdm-mailhandler.rb to create a user automaticly and create an issue on my 'unassigned' project. The created user has no groups or projects.

The non-member role has issues visibility of 'issues created by or assigned to the user'. (that was added in #7412 / r5416 ). The other permissions on the non-member role are: 'View Issues' and 'Add notes'.

a) After updating an issue there's no email notification to the user when their email notification is set to:
  • watched or involved or
  • only things I'm the owner of
    (related issues #6069 and #8497)

When logged in as the new users
b) /activity
Shows nothing

c) /issues
shows nothing

d) /my/page
shows nothing

e) /issues/3027
Direct access to the issue created by the user - 403 You are not authorized to access this page.

After creating a NONMEMBER role with the same permissions / issues visibility as the internal non-member role, and assigning the role 'NONMEMBER' on project 'unassigned' for the user, all of the above are visible and notices are sent.

Actions #1

Updated by Jean-Philippe Lang about 11 years ago

  • Status changed from New to Needs feedback

Works for me. Is your 'unassigned' project public or private?

Actions #2

Updated by Daniel Black about 11 years ago

Jean-Philippe Lang wrote:

Works for me. Is your 'unassigned' project public or private?

private.

Actions #3

Updated by Jean-Philippe Lang about 11 years ago

  • Subject changed from non-member role issue visibility 'created by or assigned to the user' unable to view own issues / or receive email notification of own issues to Non-member role with 'created by or assigned' issue visibility can't view own issues in private project
  • Status changed from Needs feedback to Closed
  • Resolution set to Invalid

Thanks but I'll have to close this one. Private projects are never visible to non-members.

Actions #4

Updated by Daniel Black about 11 years ago

ok. Thanks for your help.

patch #13340 is my work around. Hope this is acceptable.

Actions

Also available in: Atom PDF