Person:+participation is Forbidden if the person participates in a visible team via an invisible one

[Colin Watson]

When I visit https://launchpad.net/~bzoltan/+participation, I get a Forbidden error. The traceback ends with:

     Module zope.traversing.adapters, line 42, in traverse
    attr = getattr(subject, name, _marker)
    __traceback_info__: (<zope.browserpage.metaconfigure.SimpleViewClass from /srv/launchpad.net/production/launchpad-rev-17298/lib/lp/registry/browser/../templates/person-participation.pt object at 0x2b1a63d06fd0>, 'has_participations', [])
    Module lp.services.propertycache, line 116, in __get__
    value = self.populate(instance)
    Module lp.registry.browser.person, line 2036, in has_participations
    return len(self.active_participations) > 0
    Module lp.services.propertycache, line 116, in __get__
    value = self.populate(instance)
    Module lp.registry.browser.person, line 2031, in active_participations
    team=indirect_team))
    Module lp.registry.browser.person, line 1974, in _asParticipation
    [via_team.displayname for via_team in via[1:-1]])

Unauthorized: (<Person at (redacted)>, 'displayname', 'launchpad.LimitedView')<br />

(I've redacted the team name to avoid mentioning a private team in a public bug.)

I would argue that inaccessible private teams should either be omitted entirely from Person:+participation (my preference, I think) or explicitly shown as redacted, but in either case shouldn't make it impossible to see the other teams of which that person is a member.

[William Grant (wgrant)]

It's not that simple. It occurs when a user is a participant of a team you can see via a team that you can't.

[Launchpad QA Bot (lpqabot)]

Fixed in stable r17479 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/17479>.