Defect #15664
Unable to upload attachments without add_issues, edit_issues or add_issue_notes permission
| Status: | Closed | Start date: | ||
|---|---|---|---|---|
| Priority: | Normal | Due date: | ||
| Assignee: |  Jean-Philippe Lang | % Done: | 0% | |
| Category: | Permissions and roles | |||
| Target version: | 2.4.3 | |||
| Resolution: | Fixed | Affected version: |
Description
Users with the manage_files permission are currently able to call FilesController#new and FilesController#create. However, uploading files requires permission to call AttachmentsController#upload. If a user has none of the permissions add_issues, edit_issues or add_issue_notes, they cannot upload files in the files tab.
Proposed solution: allow users with the manage_files permission to call AttachmentsController#upload.
upload_file_without_issues_permission.diff 
(524 Bytes)
History
#1
Updated by Jean-Philippe Lang about 6 years ago
- Tracker changed from Patch to Defect
- Subject changed from Allow users with the manage_files flag to call AttachmentsController#upload to Unable to upload attachments without add_issues, edit_issues or add_issue_notes permission
- Status changed from New to Resolved
- Assignee set to Jean-Philippe Lang
- Target version set to 2.4.3
- Resolution set to Fixed
Confirmed and fixed in r12652 including for other actions (documents, wiki...).
Thanks for pointing this out.