Re: prevent changing Status for new issues

On 10/06/2014 09:52 AM, John P. Rouillard wrote:
> In message <[email protected]>, Stuart McGraw writes:
>>On 10/05/2014 12:11 PM, John P. Rouillard wrote:
>>> In message <[email protected]>, Stuart McGraw writes:
>[...]
>>> So by deleting Create permissions for status and resolution, you
>>> prevent people (in the User role) from creating new status entries or
>>> new resolution entries.
>>
>>Which I thought was the right thing to do.  Without the ability
>>to create a status item, it can only get created by the actions 
>>of an auditor, yes?  Which seemed like what I want.
> 
> You aren't creating a status item from the issue. You are linking to
> an already existing status item.
> 
> E.G. Status is one of "New", "Open", "Testing", "Closed" The create
> permission on status allows somebody to create a new status
> "Broken". It doesn't affect the ability of somebody to set the status
> link in the issue.
> 
> Clearer?

>[...and...]

> Does my explanation above clear this distinction up for you? If you use:
> 
>   db.security.addPermissionToRole('User', 'Create', 'status')
> 
> any User can create a new status object with all its properties.
> 
>   p=db.security.addPermission(name='Create', klass='issue',
>      properties=('status',...))
>   db.security.addPermissionToRole('User', p)
> 
> allows the user to create an issue with the listed properties.

Ah (picture of a light bulb lighting up)...of course!
Thanks, it is clear now.  Sorry about being rather dense.


------------------------------------------------------------------------------
Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk