[#6414] Check state permissions on ticket creation
Summary Check state permissions on ticket creation
Queue Whups
Type Enhancement
State Accepted
Priority 1. Low
Owners
Requester jeffclay@pioneercomputersolutions.com
Created 2008-03-09 (4295 days ago)
Due
Updated 2015-05-19 (1668 days ago)
Assigned
Resolved
Milestone
Patch No

Comments
jeffclay@pioneercomputersolutions.com 2008-03-09 21:32:01
Recently I setup whups and found that when users are authenticated, 
they have the permissions to change the state of their ticket to 
whatever they want at the creation of the ticket. However Guest users 
are forced to use the default state defined by the administrator. I 
think their should be an enhancement in permissions or something to 
allow the administrator to specify whether or not authed users must 
use default states.

Chuck Hagenbuch <chuck@horde.org> 2008-03-10 05:15:37
We should honor the Assign/Update queue sub-permissions for guests. 
That should take care of this.

Chuck Hagenbuch <chuck@horde.org> 2008-03-10 05:16:19
... assuming that when you said "authed" users, you meant 
unauthenticated users?

jeffclay@pioneercomputersolutions.com 2008-03-10 15:27:03
Yes, I meant authenticated users when I said "authed users".

jeffclay@pioneercomputersolutions.com 2008-03-10 22:42:34
> ... assuming that when you said "authed" users, you meant

> unauthenticated users?



I don't think that *all* authenticated users should have the ability 
to specify state of a ticket. Sorry for the confusion. I think the 
guest way works nice, but when the horde users go to submit a ticket, 
they have the ability to specify state; I don't think that should be 
the case by default. I think there should be a permissions setting to 
specify which (if any) authenticated users have permissions to specify 
ticket state at creation of ticket.

Chuck Hagenbuch <chuck@horde.org> 2008-03-11 02:25:49
Oh. Well that's the assign/update sub-permissions (they're child 
permissions of queues).

jeffclay@pioneercomputersolutions.com 2008-03-11 04:56:54
> Oh. Well that's the assign/update sub-permissions (they're child

> permissions of queues).



No, you're missing what I'm trying to say. On my system, I have the 
child permissions their, but none of them (authenticated, guest, 
creator, etc.) are checked on any of the child permissions (of my 
queues), but still yet; authenticated (non-administrator) users can 
create a ticket at whichever state they choose, but guest users can 
not.  Thank you for your patience.

Chuck Hagenbuch <chuck@horde.org> 2008-03-11 05:06:09
if they can then go and update the ticket to the new state, why do you 
want to force them to use two steps?

jeffclay@pioneercomputersolutions.com 2008-03-11 07:34:25
> if they can then go and update the ticket to the new state, why do

> you want to force them to use two steps?



I'm not wanting to force them to two steps.  On my system, I have 3 
ticket states (unconfirmed, assigned, accepted) that are available to 
regular authenticated users when they create a ticket. The default 
state is uncomfirmed. Guest users can only create a ticket with 
"unconfirmed" as the state. Their should be a way to force 
authenticated users to use the default state defined for the ticket 
type.

Chuck Hagenbuch <chuck@horde.org> 2008-03-11 18:53:15
So you're saying that once the ticket is created, those same users do 
not have permissions to update the ticket to be Assigned/Accepted?

jeffclay@pioneercomputersolutions.com 2008-03-11 19:09:20
> So you're saying that once the ticket is created, those same users do

> not have permissions to update the ticket to be Assigned/Accepted?



Yes, they don't have those permissions after the ticket is created; 
but they (somehow) have them at the time of ticket creation.

asa@isac.gov.in 2015-05-19 11:05:36
I am also looking for this enhancement, where, an authenticated user 
should not be allowed to select a ticket state, instead it should it 
should be set to default state only.


>> So you're saying that once the ticket is created, those same users do
>
>> not have permissions to update the ticket to be Assigned/Accepted?
>
>
>
> Yes, they don't have those permissions after the ticket is created; 
> but they (somehow) have them at the time of ticket creation.