On Fri, May 18, 2007 at 06:35:05PM -0000, Tom Haddon wrote:
> It seems that currently this allows any logged in users to delete any
> attachments. I think this should be restricted to allowing any logged in
> user to delete their own attachments, or any member of the Launchpad
> Admins team to delete any attachment.
I guess that's quite sensible, although I think bug contacts should be
able to delete attachments as well. The main reason for that is that
theres a re-tracing service for Ubuntu's crash reports, which should be
able to delete the attached core dumps. Until we have a proper crash
database, it needs to have permission to delete other people's
attachments.
On Fri, May 18, 2007 at 06:35:05PM -0000, Tom Haddon wrote:
> It seems that currently this allows any logged in users to delete any
> attachments. I think this should be restricted to allowing any logged in
> user to delete their own attachments, or any member of the Launchpad
> Admins team to delete any attachment.
I guess that's quite sensible, although I think bug contacts should be
able to delete attachments as well. The main reason for that is that
theres a re-tracing service for Ubuntu's crash reports, which should be
able to delete the attached core dumps. Until we have a proper crash
database, it needs to have permission to delete other people's
attachments.