[#1880] AttachedFile.php should respect permissions
Summary AttachedFile.php should respect permissions
Queue Wicked
Type Bug
State Resolved
Priority 2. Medium
Owners Chuck Hagenbuch <chuck (at) horde (dot) org>
Requester tasin (at) fhm (dot) edu
Created 04/28/2005 (1349 days ago)
Due
Updated 04/29/2005 (1348 days ago)
Assigned 04/28/2005 (1349 days ago)
Resolved 04/29/2005 (1348 days ago)
Attachments wicked1.diff Download
Milestone
Patch No

History
04/29/2005 Chuck Hagenbuch Comment #2
State ⇒ Resolved		 Reply to this comment
Committed, thanks.
04/28/2005 Jan Schneider Assigned to Chuck Hagenbuch
State ⇒ Assigned
 
04/28/2005 tasin (at) fhm (dot) edu Comment #1
State ⇒ Unconfirmed
Priority ⇒ 2. Medium
Type ⇒ Bug
Summary ⇒ AttachedFile.php should respect permissions
Queue ⇒ Wicked
New Attachment: wicked1.diff Download		 Reply to this comment
Like Bug #915 only for attaching files.

Actually it is possible to attach files to a page even if there is no 
edit permisson. It is also possible to create an "orphaned attached 
file" (e.g. by manual entering an URL like 
http://my.example.com/wicked/display.php?page=AttachedFiles&referrer=T123It 
where the page T123It doesn't exist).
The patch should solve these probs.