Redmine

And maybe linked to #9576 too.

Mischa 's deeper investigation report can be found in #9360 note 5.

And, BTW, according to #9576, it is a regression since it used to work fine in 1.1.0.

Etienne Massip wrote:

And maybe linked to #9576 too.

I confirm.
This is a bug of 1.2.0 on existing database. 9576

Mischa The Evil wrote in #9360:

The questions which come up in me are:

• Why does Redmine do that visible? check?
• Where (as in code) is it defined?

#AttachmentsController#read_authorize filter (source:/trunk/app/controllers/attachments_controller.rb@7819#L78) calls Attachment#visible? (source:/trunk/app/models/attachment.rb@7819#L117) which itself calls Version#visible?.

• the user needs the IssueTracking module's view_issues permission to get read access to a version (and to its contents)
• there is no need to enable IssueTracking module to manage versions

The description of issue #9360 seems to be the same as mine. Except one thing - I don`t have anonymous users so I don`t know the behavior of this issue for them. Issue #9576 is also very similar, but the description is not so detailed.

Etienne Massip wrote:

#AttachmentsController#read_authorize filter (source:/trunk/app/controllers/attachments_controller.rb@7819#L78) calls Attachment#visible? (source:/trunk/app/models/attachment.rb@7819#L117) which itself calls Version#visible?.

Thanks for this educational explanation...

I think that the inconstancy is the following:

• the user needs the IssueTracking module's view_issues permission to get read access to a version (and to its contents)
• there is no need to enable IssueTracking module to manage versions

I agree.