View Issue Details

IDProjectCategoryView StatusLast Update
0010647mantisbtbugtrackerpublic2009-10-07 14:19
Reporterkc Assigned Todhx  
PrioritynormalSeveritymajorReproducibilityalways
Status closedResolutionfixed 
Product Version1.2.0rc1 
Target Version1.2.0rc2Fixed in Version1.2.0rc2 
Summary0010647: bug_update access denied error when user hasn't got permission to update roadmap
Description

After update to 1.2rc1 I can't close any projects with access level Tester and below.
The error is: "Application Error #13 Access Denied"

TagsNo tags attached.

Relationships

has duplicate 0010702 closeddhx reporters & updaters get access denied when trying to close a resolved issue 

Activities

dhx

dhx

2009-06-29 11:05

reporter   ~0022308

By default we don't have a "tester" access level. I assume you have defined your own access level in custom_constants_inc.php (note that custom_constant_inc.php was renamed, yet they both still work until v1.3).

1.2.0rc1 includes a stack of bug fixes that make custom access levels work correctly. The fact that your TESTER level was working OK in 1.1.x is probably a bit of luck and coincidence. You will need to go through config_defaults_inc.php and copy relevant settings to your own config_inc.php file, changing the access level as required to TESTER.

Also review the documentation in reference to how you setup a custom workflow. You will need to setup the custom TESTER status correctly according to the documentation.

DominionSpy

DominionSpy

2009-06-30 03:27

reporter   ~0022319

I am having the same problem as this, but with the built-in UPDATER role.
I have changed the default settings for "All Projects" like this:

[Workflow Transitions]
Minimum access level for closed status: updater

[Workflow Thresholds]
Issues Capability
Status where an issue becomes read only: closed

For updater:
Handle an issue: yes
Move an issue: yes
Delete an issue: yes
Reopen an issue: yes
Update readonly issues: yes
Update issue status: yes
Set view status (public vs private): no
Update view status (public vs private): no
Show list of users monitoring issues: yes

Notes Capability
For updater:
Update notes: yes

Also, if the user does not have permission to perform an operation, should the option be there at all?

kc

kc

2009-06-30 03:39

reporter   ~0022320

I solved the proplem.
In the config_inc.php I changed this:

$g_handle_bug_threshold = REPORTER;

AND

$g_roadmap_update_threshold = REPORTER;

dhx

dhx

2009-06-30 03:44

reporter   ~0022321

I notice that you haven't set:

Update an issue: yes

This is required for someone to update an issue.

These checks must all be true for someone to be able to update an issue:
1) user has permission for the project (or globally) to use the 'closed' status
2) user access level has "Update an issue" aka update_bug_threshold permission
3) if the user is the reporter of the issue, they can only update it if either of allow_reporter_reopen or allow_reporter_close are true

I'm fairly certain there is a bug with (3) which I'll look into. Could you please try setting either of these options to ON in config_inc.php to see if that solves your issue? Also ensure that the "Update an issue" checkbox is ticked on the Workflow Thresholds page for the Updater access level.

dhx

dhx

2009-06-30 03:47

reporter   ~0022322

kc, I'm confused about what your actual problem was... you said "close any projects" yet I'm not sure what this means. Which page does the problem occur on (check the URL in your browser). Is it view.php?

DominionSpy

DominionSpy

2009-06-30 04:07

reporter   ~0022323

@kc
As a work around, this seems to work. I don't really understand why though.

@dhx
Update an issue is yes by default for an updater. I have just listed the options that I've changed.

In this instance, the user has not previously been involved in the issue at all, he is simply a tester who is verifying that the issue has been resolved and then closes the issue. Therefore, the options you have mentioned would appear to be irrelevant.

kc

kc

2009-06-30 05:43

reporter   ~0022326

no, it is bug_update.php

I think the error occurs because of the differnt acces levels of this two variables:

$g_handle_bug_threshold = REPORTER;
$g_roadmap_update_threshold = DEVELOPER;

The access level of the user is REPORTER.

After I changed the variables to

$g_handle_bug_threshold = REPORTER;
$g_roadmap_update_threshold = REPORTER;

everything works.

dhx

dhx

2009-06-30 06:30

reporter   ~0022327

Aha, I understand now.

This is pretty much the same bug I fixed a while ago in bug_report.php but I didn't think about porting it across to bug_update.php as well.

Please see http://git.mantisbt.org/?p=mantisbt.git;a=commit;h=bd5076906d7c8596dc3ba9ce5352c9be9c85f4b3

I'll patch this in a minute.

Thanks for your patience in trying to explain this to me :)

dhx

dhx

2009-06-30 22:37

reporter   ~0022336

Fixed. Thanks again for taking the time to report this bug!

Related Changesets

MantisBT: master c2ef5a6c

2009-06-30 22:17

dhx


Details Diff
Fix 0010647: check permissions before updating target_version

Related to bd5076906d7c8596dc3ba9ce5352c9be9c85f4b3

The new BugData class has access checks built into __set so we can't
update a field without permission to do so.

We need to ensure that target_version is only updated when the current
user has permission to do so.
Affected Issues
0010647
mod - bug_update.php Diff File
mod - api/soap/mc_issue_api.php Diff File

MantisBT: master-1.2.x ad56aaa8

2009-06-30 22:17

dhx


Details Diff
Fix 0010647: check permissions before updating target_version

Related to bd5076906d7c8596dc3ba9ce5352c9be9c85f4b3

The new BugData class has access checks built into __set so we can't
update a field without permission to do so.

We need to ensure that target_version is only updated when the current
user has permission to do so.
Affected Issues
0010647
mod - bug_update.php Diff File
mod - api/soap/mc_issue_api.php Diff File

MantisBT: master 0cfb73e9

2009-06-30 22:26

dhx


Details Diff
Don't require access check for fixed_in_version

handle_bug_threshold is documented as the threshold at which someone can
be assigned to a bug. Therefore we shouldn't be checking this threshold
when changing the fixed_in_version field - update_bug_threshold is
enough (we use it for every other field).

Fixes 0010647
Affected Issues
0010647
mod - core/bug_api.php Diff File

MantisBT: master-1.2.x 87a5dc26

2009-06-30 22:26

dhx


Details Diff
Don't require access check for fixed_in_version

handle_bug_threshold is documented as the threshold at which someone can
be assigned to a bug. Therefore we shouldn't be checking this threshold
when changing the fixed_in_version field - update_bug_threshold is
enough (we use it for every other field).

Fixes 0010647
Affected Issues
0010647
mod - core/bug_api.php Diff File