6.0.0-beta1
7/5/25

[#13341] Cannot set ACL for owner
Summary Cannot set ACL for owner
Queue IMP
Queue Version 6.2.0
Type Bug
State Not A Bug
Priority 1. Low
Owners
Requester azurit (at) pobox (dot) sk
Created 07/10/2014 (4013 days ago)
Due
Updated 07/15/2014 (4008 days ago)
Assigned
Resolved 07/11/2014 (4012 days ago)
Github Issue Link
Github Pull Request
Milestone
Patch No

History
07/15/2014 07:33:20 PM azurit (at) pobox (dot) sk Comment #11 Reply to this comment
Ok, thank you Michael.
07/15/2014 07:30:39 PM Michael Slusarz Comment #10 Reply to this comment
Put another way: you could remove the delete permission from the 
owner and the server could automatically remove ALL other 
permissions.  That is perfectly acceptable ACL behavior.  And there 
is no way for the GUI to know that unless/until you remove the 
delete permission.
Put yet another way: There is no guarantee that what you do GUI-wise 
will "stick" on the server.  (Thus, the language from the RFC I quoted 
below).
07/15/2014 07:11:04 PM Michael Slusarz Comment #9 Reply to this comment
But my IMAP server (Dovecot) seems to support this:
http://wiki2.dovecot.org/ACL

At the end, there is also 'owner' identifier.
You are not getting the point that nothing (ACL API-wise) allows the 
MUA/GUI to know that the owner's permissions can't be changed.

Put another way: you could remove the delete permission from the owner 
and the server could automatically remove ALL other permissions.  That 
is perfectly acceptable ACL behavior.  And there is no way for the GUI 
to know that unless/until you remove the delete permission.
07/15/2014 07:14:41 AM azurit (at) pobox (dot) sk Comment #8 Reply to this comment
But my IMAP server (Dovecot) seems to support this:
http://wiki2.dovecot.org/ACL

At the end, there is also 'owner' identifier.

07/14/2014 11:07:42 PM Michael Slusarz Comment #7 Reply to this comment
Ok, so how am i supposed to change ACLs for 'me' (=currently logger user)?
You can't.  At least with your IMAP backend.  This has nothing to do 
with IMP though.
The GUI seems to support this but it's not working.
It does work.  As mentioned before, it just requires that your backend 
supports it.  Yours does not.
If this is not possible, why GUI allows me to do it?
As mentioned previously... because there is no way of knowing (through 
the ACL IMAP extension) whether this is possible or not.

This would be no different than if your IMAP backend supported ACLs, 
but did not advertise support for the ACL extension (which is a 
possible scenario).  A user could have no delete rights for a mailbox, 
but since there is no way of knowing this the Delete button could not 
be hidden in the GUI.  The only way of knowing would be to try to 
delete a message, at which point you would get an error.
07/12/2014 02:10:28 PM azurit (at) pobox (dot) sk Comment #6 Reply to this comment
Ok, so how am i supposed to change ACLs for 'me' (=currently logger 
user)? The GUI seems to support this but it's not working. If this is 
not possible, why GUI allows me to do it?
07/11/2014 03:32:19 PM Michael Slusarz Comment #5 Reply to this comment
Wrong ticket # in commit message.

Changes have been made in Git (master):

commit 15a79ef7d3e70aa79ee67e4387286e339c56215a
Author: Michael M Slusarz <slusarz@horde.org>
Date:   Fri Jul 11 09:17:10 2014 -0600

      Ticket #13349: Remove explicit change button for ACL mailbox selection

      We already require javascript on this page, so this button will never be
      used.

   imp/js/acl.js                    |    3 ++-
   imp/templates/prefs/acl.html.php |    3 ++-
   2 files changed, 4 insertions(+), 2 deletions(-)

http://github.com/horde/horde/commit/15a79ef7d3e70aa79ee67e4387286e339c56215a
07/11/2014 03:30:18 PM Michael Slusarz Comment #4
State ⇒ Not A Bug
Reply to this comment
This is not a bug.

IMP has no way of knowing 1) who is the "owner" of the mailbox, or 2) 
*which* rights will be affected for any rights alteration.  This is 
all known/expected/explained in the RFC.

E.g., trying to remove the delete right on the owner user:

C: 3 GETACL Testing.AAB
S: * ACL Testing.AAB slusarz lrwstipekxacd
S: 3 OK Getacl completed.
C: 4 SETACL Testing.AAB slusarz -t
S: 4 OK Setacl complete.
C: 5 GETACL Testing.AAB
S: * ACL Testing.AAB slusarz lrwstipekxacd
S: 5 OK Getacl completed.

As can be seen, the delete right was successfully removed via GUI 
request, but the actual rights on the server didn't change.

Directly from RFC 4314 [Appendix C]:

    2.  Because this extension leaves the specific semantics of how
        rights are combined by the server as implementation defined, the
        ability to build a user-friendly interface is limited.
07/11/2014 03:25:43 PM Michael Slusarz Comment #3 Reply to this comment
I also find the change button confusing as switching folder reloads 
the permission screen anyway, so I don't see a use for it.
This was there to support non-JS clients.  But we require JS now to 
use even the Basic interface, so you are correct that this is 
superfluous.  It has been removed in git master.
07/11/2014 02:31:50 PM software-horde (at) interfasys (dot) ch Comment #2 Reply to this comment
GUI is allowig to set ACL also for folder owner but they are NOT 
saved and after reload they are back to 'all privileges'.
I can confirm this and there is nothing in the logs.

I also find the change button confusing as switching folder reloads 
the permission screen anyway, so I don't see a use for it.
07/10/2014 08:34:02 AM azurit (at) pobox (dot) sk Comment #1
Milestone ⇒
State ⇒ Unconfirmed
Patch ⇒ No
Queue ⇒ IMP
Summary ⇒ Cannot set ACL for owner
Type ⇒ Bug
Priority ⇒ 1. Low
Reply to this comment
GUI is allowig to set ACL also for folder owner but they are NOT saved 
and after reload they are back to 'all privileges'.

Saved Queries