<?xml version="1.0"?>
<rss xmlns:dc="http://purl.org/dc/elements/1.1/" version="2.0">
  <channel>
    <title>CKAN: Ticket #460: State field changed by non-sysadmin</title>
    <link>http://localhost/ticket/460</link>
    <description>&lt;p&gt;
This package:
&lt;/p&gt;
&lt;p&gt;
&lt;a class="ext-link" href="http://ckan.net/package/dbtune-audioscrobbler"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://ckan.net/package/dbtune-audioscrobbler&lt;/a&gt;
&lt;/p&gt;
&lt;p&gt;
was:
&lt;/p&gt;
&lt;ol&gt;&lt;li&gt;created by Richard (logged-in)
&lt;/li&gt;&lt;li&gt;edited by Richard (logged-in)
&lt;/em&gt;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;
(According to the logs, at this point the state was changed from 'active' to 'deleted') -- RP was it set to 'deleted' or just &lt;em&gt;?
&lt;/p&gt;
&lt;ol start="3"&gt;&lt;li&gt;pudo changed the state back to active
&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;
Similarly an incident with bibbase package where field set to &lt;em&gt; (see &lt;a class="ext-link" href="http://ckan.net/revision/diff/bibbase?diff=702bb0a3-03b7-49ac-87ad-e489c414962f&amp;amp;oldid=5447842d-b6ed-41d9-9cfd-8bb73b85c409"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://ckan.net/revision/diff/bibbase?diff=702bb0a3-03b7-49ac-87ad-e489c414962f&amp;amp;oldid=5447842d-b6ed-41d9-9cfd-8bb73b85c409&lt;/a&gt;)
&lt;/em&gt;&lt;/p&gt;
&lt;p&gt;
Need to investigate how this got changed, fix if necessary and report back to Richard. Note that package 'admins' as well as sysadmins can change the state of a package (though note that bibbase did not appear to have an owner).
&lt;/p&gt;
&lt;p&gt;
Suggested solution (for setting to &lt;em&gt;):
&lt;/em&gt;&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;Ensure in ckan/forms.py that there is a validator for state field that ensures only set to valid values.
&lt;/li&gt;&lt;li&gt;Check that we do not allow state to be changed in the api except by package owner or sysadmin
&lt;/li&gt;&lt;/ul&gt;</description>
    <language>en-us</language>
    <image>
      <title>CKAN</title>
      <url>http://assets.okfn.org/p/ckan/img/ckan_logo_shortname.png</url>
      <link>http://localhost/ticket/460</link>
    </image>
    <generator>Trac 0.12.3</generator>
    <item>
      
        <dc:creator>dread</dc:creator>

      <pubDate>Fri, 20 Aug 2010 11:11:57 GMT</pubDate>
      <title>remaining_time set</title>
      <link>http://localhost/ticket/460#comment:1</link>
      <guid isPermaLink="false">http://localhost/ticket/460#comment:1</guid>
      <description>
          &lt;ul&gt;
            &lt;li&gt;&lt;strong&gt;remaining_time&lt;/strong&gt;
                set to &lt;em&gt;1&lt;/em&gt;
            &lt;/li&gt;
          &lt;/ul&gt;
      </description>
      <category>Ticket</category>
    </item><item>
      
        <dc:creator>dread</dc:creator>

      <pubDate>Fri, 20 Aug 2010 14:02:28 GMT</pubDate>
      <title>type, description, summary changed</title>
      <link>http://localhost/ticket/460#comment:2</link>
      <guid isPermaLink="false">http://localhost/ticket/460#comment:2</guid>
      <description>
          &lt;ul&gt;
            &lt;li&gt;&lt;strong&gt;type&lt;/strong&gt;
                changed from &lt;em&gt;task&lt;/em&gt; to &lt;em&gt;defect&lt;/em&gt;
            &lt;/li&gt;
            &lt;li&gt;&lt;strong&gt;description&lt;/strong&gt;
              modified (&lt;a href="/ticket/460?action=diff&amp;amp;version=2"&gt;diff&lt;/a&gt;)
            &lt;/li&gt;
            &lt;li&gt;&lt;strong&gt;summary&lt;/strong&gt;
                changed from &lt;em&gt;Investigate Richard Cyganiak issue&lt;/em&gt; to &lt;em&gt;State field changed by non-sysadmin&lt;/em&gt;
            &lt;/li&gt;
          &lt;/ul&gt;
      </description>
      <category>Ticket</category>
    </item><item>
      
        <dc:creator>richard@…</dc:creator>

      <pubDate>Fri, 20 Aug 2010 18:46:56 GMT</pubDate>
      <title></title>
      <link>http://localhost/ticket/460#comment:3</link>
      <guid isPermaLink="false">http://localhost/ticket/460#comment:3</guid>
      <description>
        &lt;p&gt;
Note, I'm not a sysadmin but I &lt;em&gt;can&lt;/em&gt; see the Status dropdown for this package, with values "active" and "deleted". Not knowing much about the permission system, I was assuming that's because I created the package.
&lt;/p&gt;
&lt;p&gt;
I am however certain that I did not modify (or even notice) this dropdown in the mysterious edit that led to the state change from "active" to "None".
&lt;/p&gt;
      </description>
      <category>Ticket</category>
    </item><item>
      
        <dc:creator>richard@…</dc:creator>

      <pubDate>Sat, 25 Sep 2010 19:44:19 GMT</pubDate>
      <title></title>
      <link>http://localhost/ticket/460#comment:4</link>
      <guid isPermaLink="false">http://localhost/ticket/460#comment:4</guid>
      <description>
        &lt;p&gt;
I believe the initial report is incorrect. It states that the status was changed from "active" to "deleted". I believe that it was actually changed from "active" to "None".
&lt;/p&gt;
&lt;p&gt;
This might indicate a bug in the code: The value of the status field is lost.
&lt;/p&gt;
      </description>
      <category>Ticket</category>
    </item><item>
      
        <dc:creator>rgrp</dc:creator>

      <pubDate>Sun, 26 Sep 2010 08:32:44 GMT</pubDate>
      <title></title>
      <link>http://localhost/ticket/460#comment:5</link>
      <guid isPermaLink="false">http://localhost/ticket/460#comment:5</guid>
      <description>
        &lt;p&gt;
To add to this ticket I note that package 'owners' are entitled to see State not just system sysadmins (this allows owners to delete packages).
&lt;/p&gt;
      </description>
      <category>Ticket</category>
    </item><item>
      
        <dc:creator>rgrp</dc:creator>

      <pubDate>Sun, 26 Sep 2010 08:45:02 GMT</pubDate>
      <title>priority, description changed; owner, milestone set</title>
      <link>http://localhost/ticket/460#comment:6</link>
      <guid isPermaLink="false">http://localhost/ticket/460#comment:6</guid>
      <description>
          &lt;ul&gt;
            &lt;li&gt;&lt;strong&gt;owner&lt;/strong&gt;
              set to &lt;em&gt;pudo&lt;/em&gt;
            &lt;/li&gt;
            &lt;li&gt;&lt;strong&gt;priority&lt;/strong&gt;
                changed from &lt;em&gt;awaiting triage&lt;/em&gt; to &lt;em&gt;critical&lt;/em&gt;
            &lt;/li&gt;
            &lt;li&gt;&lt;strong&gt;description&lt;/strong&gt;
              modified (&lt;a href="/ticket/460?action=diff&amp;amp;version=6"&gt;diff&lt;/a&gt;)
            &lt;/li&gt;
            &lt;li&gt;&lt;strong&gt;milestone&lt;/strong&gt;
                set to &lt;em&gt;ckan v1.3&lt;/em&gt;
            &lt;/li&gt;
          &lt;/ul&gt;
      </description>
      <category>Ticket</category>
    </item><item>
      
        <dc:creator>dread</dc:creator>

      <pubDate>Thu, 13 Jan 2011 10:53:40 GMT</pubDate>
      <title>component set</title>
      <link>http://localhost/ticket/460#comment:7</link>
      <guid isPermaLink="false">http://localhost/ticket/460#comment:7</guid>
      <description>
          &lt;ul&gt;
            &lt;li&gt;&lt;strong&gt;component&lt;/strong&gt;
                set to &lt;em&gt;ckan&lt;/em&gt;
            &lt;/li&gt;
          &lt;/ul&gt;
      </description>
      <category>Ticket</category>
    </item><item>
      
        <dc:creator>shevski</dc:creator>

      <pubDate>Fri, 08 Jul 2011 11:57:28 GMT</pubDate>
      <title>repo, theme set; milestone deleted</title>
      <link>http://localhost/ticket/460#comment:8</link>
      <guid isPermaLink="false">http://localhost/ticket/460#comment:8</guid>
      <description>
          &lt;ul&gt;
            &lt;li&gt;&lt;strong&gt;repo&lt;/strong&gt;
                set to &lt;em&gt;ckan&lt;/em&gt;
            &lt;/li&gt;
            &lt;li&gt;&lt;strong&gt;theme&lt;/strong&gt;
                set to &lt;em&gt;none&lt;/em&gt;
            &lt;/li&gt;
            &lt;li&gt;&lt;strong&gt;milestone&lt;/strong&gt;
                &lt;em&gt;ckan-v1.5&lt;/em&gt; deleted
            &lt;/li&gt;
          &lt;/ul&gt;
      </description>
      <category>Ticket</category>
    </item><item>
      
        <dc:creator>thejimmyg</dc:creator>

      <pubDate>Wed, 20 Jul 2011 15:47:48 GMT</pubDate>
      <title>status changed; resolution set</title>
      <link>http://localhost/ticket/460#comment:9</link>
      <guid isPermaLink="false">http://localhost/ticket/460#comment:9</guid>
      <description>
          &lt;ul&gt;
            &lt;li&gt;&lt;strong&gt;status&lt;/strong&gt;
                changed from &lt;em&gt;new&lt;/em&gt; to &lt;em&gt;closed&lt;/em&gt;
            &lt;/li&gt;
            &lt;li&gt;&lt;strong&gt;resolution&lt;/strong&gt;
                set to &lt;em&gt;fixed&lt;/em&gt;
            &lt;/li&gt;
          &lt;/ul&gt;
        &lt;p&gt;
This is most likely fixed in the new logic layer refactor but is more than 6 months old anyway so closing in line with our new ticketing policy.
&lt;/p&gt;
      </description>
      <category>Ticket</category>
    </item>
 </channel>
</rss>