Question

Finalizing my next plug-in and trying to lock down the security.

As I've discussed in the forums before, when you join custom tables into a BugEventQuery (or any of the other standard queries) the built in security check isn't applied and you have to turn on IgnorePermissons to avoid a security error.

This is currently forcing me to instantiate a CBug object for every returned bug and use it to check permissions, which is murder on the DB for larger queries.

I was wondering if you would be willing to reveal the exact joins/where conditions normally used to check security on bugs when IgnorePermissions is turned off. That way I could just manually add that logic to my query and do it all in one hit to the DB.

Is this something you would be willing to divulge?

Answer 1

We give you the source code, so it's not exactly a secret :) It looks something like this:

WHERE Bug.ixProject IN (1, 2, 4, 5, 9, 11 .. )

You can generate that list of projects using a CProjectQuery like so:

CProjectQuery query = api.Project.NewProjectQuery()
query.ExcludeUnreadableWithin = true;
int[] ids = query.ListIds();

The unfortunately named ExcludeUnreadableWithin property means "don't include any projects within which I cannot read bugs". If what you're really after is writable, then use the ExcludeUnwritableWithin property.

Edit

These are not to be confused with ExcludeUnreadable and ExcludeUnwritable, which refer to the Project object itself, not Bugs within a project. For example,

• Modifying the project name (sProject) requires write permission on the Project because you must be an admin.

• Creating a bug in the project requires write permission within the project, not admin permissions