On Saturday, July 18, 2015 at 3:18:53 AM UTC-7, f.po...@gmail.com wrote: > > Hi, and thanks for your work on trac and PrivateCommentPlugin. > > From what I understand, I cannot use ITicketManipulator because that code > gets called *during* validation. It is still possible that my code gets > called but the comment is not accepted because another ITicketManipulator > called later rejects it. I'd be happy to submit a patch to > PrivateCommentPlugin, but first I have to figure out a working approach, > and I am afraid I cannot find any with the current available interfaces. > > -federico >
I was thinking that you had some ticket validation to perform on your own. I haven't tried to reproduce the scenario you describe of "forging invalid requests". Assuming that can be done, what if we moved the logic from pre_process_request to post_process_request, and/or added permission checks in the IRequestFilter? -- You received this message because you are subscribed to the Google Groups "Trac Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to trac-users+unsubscr...@googlegroups.com. To post to this group, send email to trac-users@googlegroups.com. Visit this group at http://groups.google.com/group/trac-users. For more options, visit https://groups.google.com/d/optout.
