Knowledge Base - Attachments not working for internal readers

[MathiasVolkmer]

Infos:

• Used Zammad version: 3.1.x
• Installation method (source, package, ..): Package
• Operating system: Debian
• Database + version: Postgresql 9.6
• Elasticsearch version: 5.6.16
• Browser + version: Firefox 69.0.3

Expected behavior:

Admin is creating a Knowledge Base answer with adding inlay pictures and attachments.
If the answer is marked internal, all agents should see it and also see the inlay pictures and are able to open/download the attachments.
If marked as public, everyone should be able to do so.

Actual behavior:

If the answer is marked internal visible, the agents (reading only) are able to access the answer, but won't see the inlay pictures and aren't able to download any attachment.
If the answer is marked as public, the agents (reading only) are able to see the pictures and can download the attachments.
Also, if the agent is given "editor"-rights, he is able to see the pictures and download the attachments.

Steps to reproduce the behavior:

1. Create an answer in the knowledge base with an inlay picture and an attachment
2. Set the visibility to "internal", to let agents see the answer
3. Log in as agent, who has reading access to the knowledge base, but no editing access
4. You will see the answer, but the image won't show and you won't be able to download the attachment.

Yes I'm sure this is a bug and no feature request or a general question.

[thorsteneckel]

Hey @MathiasVolkmer - thanks for reporting this! @mantas - can you please have a look?

[MathiasVolkmer]

Thanks @thorsteneckel !
I first didn't see this issue, because I created the answers, building something like an internal "wiki".. until now a colleague told me, he isn't able to get the attachments.
I won't set the answers public, because there are some internal information, that is not mentioned for guests or customers.
And I don't like to set all the agents to editors, so they would be able to edit the answers. But for now I will go that way and have to tell them to be very careful what they do :-)

[MrGeneration]

I can partly reproduce this.
On my installation I can see inline images without any problems, but any kind of attachment seems to fail terribly when having reader rights only (just as remark for mantas) :)

[mantas]

@MrGeneration did you test it when logging in directly rather than switching a user? I smell one more bug in there...

[MrGeneration]

@mantas just tested with direct login, the issue shows exactly the same way like above.
Interestingly on both tries my Chrome tells me "error - no file" when trying to download the attachments.

I also forced a reload to enforce a clean cache to ensure the inline image is not some relict from before.

[MathiasVolkmer]

I tried to reproduce it myself again:
My view:

Login as an agent with reading rights:

So I assumed, the issue about the inlay pictures is quite the same as for the attachments. Maybe there are two different issues.

[MrGeneration]

Please provide, if possible, as screencast on how you insert those images, I slowly think that you're hitting a general limitation of Zammad (for the inline image)

You can double check this by reloading the answer as agent that can edit. If the image is still there, then this is not the issue I'm talking about, but something else.

[MathiasVolkmer]

@MrGeneration After giving editor-rights to that agent and log back in with his account, the pictures are showing. So I'm quite sure that it's not the problem how I add the pictures.

• Logging in as agent without editor-rights
  -> Images won't show, even after reloading the answer
• Logging back in as administrator and giving editor-rights to the agent
• Logging back in as agent
  -> Images are showing
• Logging back in as administrator and removing editor-rights
• Logging back in as agent
  -> Images are still showing
• Reloading browser
  -> Images are gone

So there seems to be an access-issue to the files attached to an answer depending on the different roles.

Right now I'm not able to create a screencast. But I can provide one, if it's necessary.

[mantas]

@MathiasVolkmer I was able to reproduce the issue for both attachment and inline image. Fix is coming soon.