By default in trac the TICKET_CREATE permission is used to determine if you can reopen a ticket. ;( The logic there was that reopening an existing ticket is similar to creating a new ticket.

There is a way we could adjust this however with the tracworkflow plugin.

Login and look at the Workflow admin section. You should be able to change reopen to require trac_admin or whatever you like. Or if you like I'd be happy to try and get it working too...

I'm going to unmark sensitive here.

Thanks for looking Kevin.
Will give a head-up to the fm-list first about need trac-admin to re-open tickets.
Then I'll give it a gander.

The problem is not the workflow but the user being able to modify the ticket without being a member of the freemedia group.

If someone is not a member of freemedia group, he/she should not be able to access the tickets. We had a check in place for that - I don't know something is broken.

Thanks.

Something probibly changed when we switched to openid?

In any case can you explain how it should be?

No one can see or open or reopen tickets unless they are in the freemedia group?

Or ?

I'll be happy to try and get it back to working the way you want.

Replying to [comment:4 kevin]:

No one can see or open or reopen tickets unless they are in the freemedia group?

This is what we need.

But anonymous should still have "CREATE_TICKET"

This seems to have reared it's head again.
https://fedorahosted.org/freemedia/ticket/12287

Have check FAS, person is not in Freemedia group.

This is caused by the fact that the OpenID authentication module had no support for groups.
I have added this recently, and the version on fedorahosted will be upgraded soon to include group support, and thus group-based permissions.

Please note that this will require someone to update the actual permissions in trac itself, as the current setup is "any authenticated user has TICKET_EDIT", and the group membership was checked at the mod_auth_pgsql level.

Appreciate the feedabck.

Okay, this upgrade has been done, configuration as well.

At this moment, the permissions in trac are granted to the freemedia group.

Please let us know if you need anything else.