https://www.redmine.org/https://www.redmine.org/favicon.ico?16793021292011-09-30T16:17:49ZRedmineRedmine - Defect #9360: Deactivating the issue-tracking module makes project's files, bound to project's versions, inaccessiblehttps://www.redmine.org/issues/9360?journal_id=326152011-09-30T16:17:49ZG N
<ul></ul><p>I am quite certain that the situation I described above has not always been the case, because I am sure downloads worked in the past, even if issue tracking was deactivated.</p>
<p>I selected "1.2.1" as the affected version, but the problem might have been introduced in another release, so the affected versions might be more than just 1.2.1.</p> Redmine - Defect #9360: Deactivating the issue-tracking module makes project's files, bound to project's versions, inaccessiblehttps://www.redmine.org/issues/9360?journal_id=334352011-10-31T17:14:35ZAntonio García-Domínguez
<ul></ul><p>We are also experiencing this bug. We noticed this when we migrated from 0.8.6 to 1.2.1 as well.</p>
<p>The code involved seems to be in <a class="source" href="https://www.redmine.org/projects/redmine/repository/svn/entry/trunk/app/models/version.rb#L43">source:trunk/app/models/version.rb#L43</a>, which only allows users to view a version if they have the <em>:view_issues</em> permission. Shouldn't we use a different permission for this?</p> Redmine - Defect #9360: Deactivating the issue-tracking module makes project's files, bound to project's versions, inaccessiblehttps://www.redmine.org/issues/9360?journal_id=334722011-11-03T01:12:20ZMischa The Evil
<ul></ul><p>Can you test if this behaviour also happens with files which aren't linked to a particular Redmine project version?</p> Redmine - Defect #9360: Deactivating the issue-tracking module makes project's files, bound to project's versions, inaccessiblehttps://www.redmine.org/issues/9360?journal_id=334772011-11-03T09:22:35ZAntonio García-Domínguez
<ul></ul><p>No, it doesn't. If the file is not linked to any version, I can download it just fine. That's how we noticed this problem, actually: some files would download just fine, and some didn't. After some probing, we found out that the failing files were those linked to a certain version.</p> Redmine - Defect #9360: Deactivating the issue-tracking module makes project's files, bound to project's versions, inaccessiblehttps://www.redmine.org/issues/9360?journal_id=335092011-11-05T03:19:36ZMischa The Evil
<ul><li><strong>Subject</strong> changed from <i>Deactivating the issue-tracking module makes project's files inaccessible</i> to <i>Deactivating the issue-tracking module makes project's files, bound to project's versions, inaccessible</i></li></ul><p>I've just took a quick look at the related code for this.</p>
<p><em>Antonio García-Domínguez</em> wrote:</p>
<blockquote>
<p>The code involved seems to be in <a class="source" href="https://www.redmine.org/projects/redmine/repository/svn/entry/trunk/app/models/version.rb#L43">source:trunk/app/models/version.rb#L43</a>, which only allows users to view a version if they have the <code>:view_issues</code> permission. Shouldn't we use a different permission for this?</p>
</blockquote>
<p>No, I don't think so. For <strong><code>versions</code></strong> it's the right permission to use, I think.<br />As you already say which line is involved, I've tested it by changing it to match the <code>:view_files</code> permission. This obviously "works around" the problem, but it shows what the real issue looks like.</p>
<p>Before the download starts, Redmine checks if the <code>Version</code> is <code>visible?</code> when attachments have a <code>Version</code> as container-type. It looks to me it does the same on <code>Project</code> for <code>Project</code> container-type. This works for <code>Project</code> without problems since they can obviously not be disabled as a module as it's possible with issue-tracking. Whenever the issue-tracking module is disabled <code>Version.visible?</code> returns <code>false</code> which results in the here documented issue.</p>
The questions which come up in me are:
<ul>
<li>Why does Redmine do that <code>visible?</code> check?</li>
<li>Where (as in code) is it defined?</li>
</ul>
I did a quick try to find the answers to the above questions but haven't succeeded due to:
<ol>
<li>the fact I am not a Redmine core developer and</li>
<li>the fact I am not familiar with the attachments code at all.</li>
</ol>
<p>I'll leave it up to the Redmine core developers, but clearly the defect is reproducible.</p> Redmine - Defect #9360: Deactivating the issue-tracking module makes project's files, bound to project's versions, inaccessiblehttps://www.redmine.org/issues/9360?journal_id=338082011-11-16T08:31:30ZEtienne Massip
<ul><li><strong>Status</strong> changed from <i>New</i> to <i>Closed</i></li><li><strong>Resolution</strong> set to <i>Duplicate</i></li></ul><p>Closed as duplicate of <a class="issue tracker-1 status-5 priority-4 priority-default closed" title="Defect: Version files in Files module cannot be downloaded if issue tracking is disabled (Closed)" href="https://www.redmine.org/issues/9055">#9055</a>.</p>