It's not possible to set someone else as bug supervisor

Bug #479331 reported by Graham Binns
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Launchpad itself
Fix Released
High
Abel Deuring

Bug Description

What happens:
If you try to set someone else who isn't a team as bug supervisor, you get an OOPS: OOPS-1409H2046, OOPS-1409S143. UserCannotSubscribePerson: gmb does not have permission to subscribe sinzui.

What should happen:
It should be possible to set another person as bug supervisor, as long as that Person is not a team of which you're not an admin. William Grant described the issue in a comment on bug 438985 thus:

"Reading the view code also revealed another issue: there is a permission conflict. When setting the bug supervisor, you can set it to any person, or a team you administer. This implicitly adds a structural subscription for them. In other places you can only subscribe *yourself* or a team you administer. The latter restriction is now implemented in the model, so attempting to set the bug supervisor to another non-team person will fail similarly. I'm not sure how best to resolve this one."

Tags: lp-bugs oops
Deryck Hodge (deryck)
Changed in malone:
milestone: none → 3.1.11
description: updated
Revision history for this message
Abel Deuring (adeuring) wrote :

I discussed this with Graham, and we identified two problems:

1. Making it possible to appoint everybody (except teams you don't administer) may lead to an unpleasant suprise for a supervisor who isn't aware of the consequesnces of his new role: lots of bug mail.
2. The current permission check for structural subscriptions in StructuralSubscriptionTargetMixin._userCanAlterSubscription() already has a special case when the subscription target is an IDistributionSourcePackage, where more people are allowed to subscribe somebody else. Adding another special case, in this case for the new subscriber getting the "new hat" of a bug supervisor would make the code even more convoluted.

Especially issue 1 needs a bit more discussion. Our idea is to implement a process, where a person/team is first proposed to become the bug supervisor, and where the proposed person/team can then explicitly accept or decline this role.

This is a bit outside of the scope of fixing an OOPS, so we'll leave the permissions as they are right now. To fix this bug, I'll only catch the exception lthat leads to the OOPS and show the user a polite error message.

Changed in malone:
status: Triaged → In Progress
Abel Deuring (adeuring)
Changed in malone:
assignee: nobody → Abel Deuring (adeuring)
Revision history for this message
Diogo Matsubara (matsubara) wrote : Bug fixed by a commit
Changed in malone:
status: In Progress → Fix Committed
Revision history for this message
Eleanor Berger (intellectronica) wrote :

I think we should just allow the user to set anyone as the bug supervisor. I doubt this will be abused.

Abel Deuring (adeuring)
Changed in malone:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.