304226 - Trying to view an attachment to a bug requiring group membership should not give the same error as viewing the bug itself

Status: NEW

(Bugzilla :: Attachments & Requests, defect, P3)

Description

[timeless]

steps:
1. log out.
2. follow a link to attachment 192279 [details]
2' Access Denied
	  	
You are not authorized to access bug #304224. To see this bug, you must first 
log in to an account with the appropriate permissions.

3. click the "log in to an account" link
4. log in
4' bug 304224
4` attachment 192279 [details]

Comment 1

[Frédéric Buclin]

Please don't say "private" as "private" attachments and "private" comments are
another feature. Maybe "restricted"?

/me was going to invalidate this bug due to that.

Comment 2

[timeless]

i suppose some expected results might be useful, although it seemed obvious.

Access Denied to attachment 192279 [details]
	  	
You are not authorized to access attachment 192279 [details]. To see this attachment, you must first log in to an account with the appropriate permissions.

Comment 3

[Guy Pyrzak]

this doesn't need any UE evaluation, You're 100% correct timeless. The fix is if you go to an attachment URL that you don't have access to, the error should say you don't have access to the attachment not to the bug. 

Help users recognize, diagnose, and recover from errors
    Error messages should be expressed in plain language (no codes), precisely indicate the problem, and constructively suggest a solution.

Comment 4

[Brian Hay]

Attachment: same problem

Thanks from ganencontde1978.