launchpad-dev team mailing list archive

[Michael Hudson <michael.hudson@xxxxxxxxxxxxx>]

On Tue, 21 Sep 2010 11:58:45 -0400, Curtis Hovey <curtis.hovey@xxxxxxxxxxxxx> wrote:
> Projects and Distributions and Teams
> ....................................
> 
> For projects and distributions, the private primary structure rule means
> that series, milestones, releases, downloads, and announcements are private.
> They cannot be made public and users cannot be subscribed to these items
> to gain access.
> 
> For teams, archives, mailing-lists, and polls are private. This is true now.
> When teams are used in project or team roles (owner, driver, members, mirror
> admins), the team must be restricted to ensure a user cannot gain access
> though team membership.
> 
> The TeamParticipation code requires review and probable revision because
> this mechanism for determining indirect membership is not aware of privacy.

I guess the code that flips a team from restricted to open also needs to
be made aware of this.  Two second instinct is that you don't need to
change TeamParticipation itself, but only code that touches it -- but am
not sure about that.

Cheers,
mwh