Defect #15664
Unable to upload attachments without add_issues, edit_issues or add_issue_notes permission
Status: | Closed | Start date: | ||
---|---|---|---|---|
Priority: | Normal | Due date: | ||
Assignee: | % Done: | 0% | ||
Category: | Permissions and roles | |||
Target version: | 2.4.3 | |||
Resolution: | Fixed | Affected version: |
Description
Users with the manage_files
permission are currently able to call FilesController#new
and FilesController#create
. However, uploading files requires permission to call AttachmentsController#upload
. If a user has none of the permissions add_issues
, edit_issues
or add_issue_notes
, they cannot upload files in the files tab.
Proposed solution: allow users with the manage_files
permission to call AttachmentsController#upload
.
History
#1
Updated by Jean-Philippe Lang about 7 years ago
- Tracker changed from Patch to Defect
- Subject changed from Allow users with the manage_files flag to call AttachmentsController#upload to Unable to upload attachments without add_issues, edit_issues or add_issue_notes permission
- Status changed from New to Resolved
- Assignee set to Jean-Philippe Lang
- Target version set to 2.4.3
- Resolution set to Fixed
Confirmed and fixed in r12652 including for other actions (documents, wiki...).
Thanks for pointing this out.