Example, you are regular user, not an admin. On a ticket listing page you can click on the "Creator" column header and see all Creators listed as choices, even those of tickets that have been marked as deleted and are not visible to you.
In paged_search
I think we need to have something like the show_deleted
logic added in to the q
query as well. Regular users that aren't going to have access to private or deleted tickets should have those omitted in the initial search. (Maybe just for deleted tickets and not private tickets, since private tickets will have certain users (submitter) that does have access to it)
Under class
Globals
in model/ticket.py , I can add another property:@property def not_closed_deleted_query(self): return self.not_closed_query+' && deleted:False'
& In tracker_main.py , in class RootController , method index(),
I replace
c.app.globals.not_closed_query
withc.app.globals.not_closed_deleted_query
as the query for paged_query_or_searchWhat about other pages like a search or when you click on a milestone? Those run from different controllers than
index
. And admins have a "Show deleted tickets" link, so we'll want that option to continue to work for them.In class
Ticket
, I can add a class methodThen, in
paged_query_or_search()
, I can modify thesearch_query
using this methodThis fixes the issue for all the pages-tickets,milestones. "Show deleted tickets" still works
Cool - if it all works, submit a merge request and I can take a better look at it that way.
Fixed with https://forge-allura.apache.org/p/allura/git/merge-requests/187/