https://www.redmine.org/https://www.redmine.org/favicon.ico?16793021292011-11-05T13:27:55ZRedmineRedmine - Defect #9500: Watchers list before and after creation issuehttps://www.redmine.org/issues/9500?journal_id=335382011-11-05T13:27:55ZEtienne Massip
<ul><li><strong>Category</strong> set to <i>Issues</i></li></ul> Redmine - Defect #9500: Watchers list before and after creation issuehttps://www.redmine.org/issues/9500?journal_id=335432011-11-05T13:40:06ZEtienne Massip
<ul><li><strong>Affected version (unused)</strong> set to <i>1.2.1</i></li><li><strong>Affected version</strong> set to <i>1.2.1</i></li></ul> Redmine - Defect #9500: Watchers list before and after creation issuehttps://www.redmine.org/issues/9500?journal_id=337922011-11-16T00:39:01ZMischa The Evil
<ul></ul><p>I can confirm this issue. I came around this first while doing research for <a class="issue tracker-2 status-5 priority-4 priority-default closed" title="Feature: Watchers can not see the ticket status, if their role is set to only own or assigned tickets. (Closed)" href="https://www.redmine.org/issues/9330">#9330</a> but failed to report it properly yet :-/</p>
<p>What I can remember of this is that this is due to the fact that the used add-watcher mechanism is different at both states (<em>during</em> issue creation and <em>after</em> issue creation).</p>
<p>During issue creation the addable watcher users are retrieved via <a class="source" href="https://www.redmine.org/projects/redmine/repository/svn/revisions/7791/entry/trunk/app/views/issues/_form.html.erb#L32">source:/trunk/app/views/issues/_form.html.erb@7791#L32</a> which proposes all members of the project wherein the issue is being created as addable watcher users:<br /><pre><code class="rhtml syntaxhl"><span class="cp"><%</span> <span class="vi">@issue</span><span class="p">.</span><span class="nf">project</span><span class="p">.</span><span class="nf">users</span><span class="p">.</span><span class="nf">sort</span><span class="p">.</span><span class="nf">each</span> <span class="k">do</span> <span class="o">|</span><span class="n">user</span><span class="o">|</span> <span class="cp">-%></span></code></pre></p>
After issue creation the addable watcher users are retrieved via <a class="source" href="https://www.redmine.org/projects/redmine/repository/svn/revisions/7791/entry/trunk/app/views/watchers/_watchers.html.erb#L19">source:/trunk/app/views/watchers/_watchers.html.erb@7791#L19</a> which correctly proposes only the users who have actual permission to watch the to-be watched object as addable watcher users:<br /><pre><code class="rhtml syntaxhl"><span class="nt"><p></span><span class="cp"><%=</span> <span class="n">f</span><span class="p">.</span><span class="nf">select</span> <span class="ss">:user_id</span><span class="p">,</span> <span class="p">(</span><span class="n">watched</span><span class="p">.</span><span class="nf">addable_watcher_users</span><span class="p">.</span><span class="nf">collect</span> <span class="p">{</span><span class="o">|</span><span class="n">m</span><span class="o">|</span> <span class="p">[</span><span class="n">m</span><span class="p">.</span><span class="nf">name</span><span class="p">,</span> <span class="n">m</span><span class="p">.</span><span class="nf">id</span><span class="p">]}),</span> <span class="ss">:prompt</span> <span class="o">=></span> <span class="s2">"--- </span><span class="si">#{</span><span class="n">l</span><span class="p">(</span><span class="ss">:actionview_instancetag_blank_option</span><span class="p">)</span><span class="si">}</span><span class="s2"> ---"</span> <span class="cp">%></span></code></pre><br />This "way of retrieving" addable watcher users has some extras like:
<ul>
<li><a class="changeset" title="Make sure user can not watch what he is not allowed to view." href="https://www.redmine.org/projects/redmine/repository/svn/revisions/3170">r3170</a>, Users can not watch what they are not allowed to view.</li>
<li><a class="changeset" title="Do not propose users that can't view an issue as watchers (#7412)." href="https://www.redmine.org/projects/redmine/repository/svn/revisions/5876">r5876</a>, Users that can't view an issue are not proposed as watchers</li>
<li><a class="changeset" title="Fixed: validation error on issue creation when trying to add an invalid user as a watcher (#5373)." href="https://www.redmine.org/projects/redmine/repository/svn/revisions/5880">r5880</a>, Fixed: validation error on issue creation when trying to add an invalid user as a watcher</li>
</ul>
<p>Based on the above I'd suggest to change the way how addable watcher users are retrieved during issue creation. Instead of proposing <code>@issue.project.users</code> I think it would be better if <code>watched.addable_watcher_users</code> is being proposed.</p>
<p>Hope this is of any use...</p> Redmine - Defect #9500: Watchers list before and after creation issuehttps://www.redmine.org/issues/9500?journal_id=352122012-01-06T09:28:09ZPeter Brogren
<ul></ul><p>I can also confirm the issue, and do agree with the original reporter that this is an issue. My reasoning is that while I agree with what Mischa is saying about not suggesting to add watchers that don't have the permission, if <strong>I</strong> have the permission to add others as watchers I think I should get the full list of people that belong to the project to choose from. So, there should be two separate cases depending on whether I have permission to add others as watchers or not.</p>
<p>The typical case, which I'd say will happen quite regularly, is that an issue is marked as private and as the bug gets worked on I realize I want to add someone as a watcher that wasn't included from the start.</p>
<p>I agree with point <a class="changeset" title="Make sure user can not watch what he is not allowed to view." href="https://www.redmine.org/projects/redmine/repository/svn/revisions/3170">r3170</a> above with the addition "unless someone with permission to add watchers adds them".</p> Redmine - Defect #9500: Watchers list before and after creation issuehttps://www.redmine.org/issues/9500?journal_id=368802012-03-18T12:18:12ZTerence Mill
<ul></ul><p>+1</p> Redmine - Defect #9500: Watchers list before and after creation issuehttps://www.redmine.org/issues/9500?journal_id=454052013-02-07T13:49:51ZStanislav Židek
<ul></ul><p>I would also be glad if you cannot add a watcher to whom the issue would not be visible also at the time of issue creation.</p> Redmine - Defect #9500: Watchers list before and after creation issuehttps://www.redmine.org/issues/9500?journal_id=525492013-10-14T08:21:13ZToshi MARUYAMA
<ul><li><strong>Related to</strong> <i><a class="issue tracker-1 status-5 priority-4 priority-default closed" href="/issues/15123">Defect #15123</a>: "Add watcher" leaks all active users</i> added</li></ul> Redmine - Defect #9500: Watchers list before and after creation issuehttps://www.redmine.org/issues/9500?journal_id=528692013-10-30T10:01:18ZToshi MARUYAMA
<ul><li><strong>Related to</strong> <i><a class="issue tracker-2 status-5 priority-4 priority-default closed" href="/issues/11724">Feature #11724</a>: Prevent users from seeing other users based on their project membership</i> added</li></ul>