[Tickets #13836] Re: Nag Block Task Summery does not check show perm

[noreply at bugs.horde.org]

BITTE NICHT AUF DIESE NACHRICHT ANTWORTEN. NACHRICHTEN AN DIESE  
E-MAIL-ADRESSE WERDEN NICHT GELESEN.

Ticket-URL: https://bugs.horde.org/ticket/13836
------------------------------------------------------------------------------
  Ticket           | 13836
  Aktualisiert Von | michael.menge at zdv.uni-tuebingen.de
  Zusammenfassung  | Nag Block Task Summery does not check show perm
  Warteschlange    | Nag
  Version          | 4.2.3
  Typ              | Bug
  Status           | Feedback
  Priorität        | 2. Medium
  Milestone        |
  Patch            |
  Zuständige       |
------------------------------------------------------------------------------


michael.menge at zdv.uni-tuebingen.de (2015-02-12 08:39) hat geschrieben:

> This may be inconsistent but is inherently correct.
>

Maybe I don't understand the permissions system #4021, but ...

> In the portal block you have the option to show tasks from *all*  
> lists, which includes lists with read but without show permissions.  
> In the regular interface there is no such *all* option, you pick the  
> displayed lists individually. And since non-show lists are not  
> displayed, you cannot select them, even if you had read permissions.

... at no other place that I have found that you can select from *all*  lists.
I can see and read task that I did not create, from a task list that I  
can't select/deselct
in the the nag block configuration and I don't have access to that  
task list at any other place.
You can access task from task lists you can't see in nag, or the block  
configuration otherwise.

So this is supprising from the users (the user that sees the task from  
an unkonwn other person
and the person owning the task list, that *all* other users see the  
taks) point of view.

This is changed between horde 3.3. and nag 2.3 and horde 5.2 and nag 4.2.