Redmine

I've just took a quick look at the related code for this.

Antonio García-Domínguez wrote:

The code involved seems to be in source:trunk/app/models/version.rb#L43, which only allows users to view a version if they have the :view_issues permission. Shouldn't we use a different permission for this?

No, I don't think so. For versions it's the right permission to use, I think.
As you already say which line is involved, I've tested it by changing it to match the :view_files permission. This obviously "works around" the problem, but it shows what the real issue looks like.

Before the download starts, Redmine checks if the Version is visible? when attachments have a Version as container-type. It looks to me it does the same on Project for Project container-type. This works for Project without problems since they can obviously not be disabled as a module as it's possible with issue-tracking. Whenever the issue-tracking module is disabled Version.visible? returns false which results in the here documented issue.

• Why does Redmine do that visible? check?
• Where (as in code) is it defined?

1. the fact I am not a Redmine core developer and
2. the fact I am not familiar with the attachments code at all.

I'll leave it up to the Redmine core developers, but clearly the defect is reproducible.

Closed as duplicate of #9055.