Re: Get all issues with attached files

On Thu, Oct 02, 2014 at 10:33:02AM +0300, anatoly techtonik wrote:
> 
> The interface is broken for my case:
> 
> >>> import xmlrpclib
> >>> z = xmlrpclib.ServerProxy('http://bugs.python.org/xmlrpc', allow_none=True)
> >>> from pprint import pprint as pp
> >>> pp(z.display('issue9643', 'files'))
> {'files': []}
> >>> pp(z.filter('issue', ['9643'], {'files':-1}))
> ['9643']
> >>> pp(z.filter('issue', ['9643'], {'files':[]}))
> ['9643']
> >>> pp(z.filter('issue', ['9643'], {'files':['888']}))
> ['9643']
> >>> pp(z.filter('issue', ['9643'], {'files':'888'}))
> ['9643']
> 
> There is definitely a `files` field which is empty, but no way to check that.
> The Roundup is also suspiciously silent about if query is invalid.

This looks to me as if you don't have search permission on issue.files.

To recap: I've added Search permissions quite some time ago, otherwise a
user could sort-of "triangulate" interesting properties which she would
have no View permission but by searching could infer the interesting
property.

The default for Search permission is View permission -- but only if the
View permission is not tied to a check-function. My guess is that there
is a check-function on issue.files in the python bug-tracker so the
default search permission doesn't apply.

When searching for a property you have no search permission on, the
property is ignored in the search. Your test looks exacly like that is
happening.

This is from a test tracker I'm running which allows view/search of all
files to the logged-in user:

>>> import xmlrpclib
>>> from pprint import pprint as pp
>>> p2 = xmlrpclib.ServerProxy('http://ralf:<censored>@bee:8080/xmlrpc')
>>> pp (p2.display ('issue4711', 'files'))
{'files': ['1276', '1277']}
>>> pp (p2.display ('issue4712', 'files'))
{'files': []}
>>> pp (p2.filter ('issue', ['4711', '4712'], {'files':['-1']}))
['4712']

Note that you need to quote the '-1', the code ask for a string not an
int. One of the legacies of roundup is that id attributes are strings
:-)

I've tried that on bugs.python.org with my login and it seems my search
permission is restricted, too (not just the anonymous user as in your
example):

>>> p = xmlrpclib.ServerProxy('http://runtux:<censored>@bugs.python.org/xmlrpc', allow_none=True)
>>> pp (p.display ('issue9643', 'files'))
{'files': []}
>>> pp (p.display ('issue9644', 'files'))
{'files': ['18578']}
>>> pp (p.filter ('issue', ['9643', '9644'], {'files' : ['-1']}))
['9643', '9644']

Same for messages:
>>> pp (p.display ('issue9643', 'messages'))
{'messages': ['114386', '114442', '227774']}
>>> pp (p.display ('issue9644', 'messages'))
{'messages': ['114392', '178696', '178697', '178765', '178766',
'178767']}
>>> pp (p.filter ('issue', ['9643', '9644'], {'messages' : ['-1']}))
['9643', '9644']
>>> pp (p.filter ('issue', ['9643', '9644'], {'messages' : ['178765']}))
['9643', '9644']


Note that the attribute 'nosy' doesn't seem to be restricted on
bugs.python.org:

>>> pp (p.display ('issue1723', 'nosy'))
{'nosy': []}
>>> pp (p.display ('issue1724', 'nosy'))
{'nosy': ['8', '114']}
>>> pp (p.filter ('issue', ['1723', '1724'], {'nosy' : ['-1']}))
['1723']


To add search permissions for a property you would add something like the
following:

p = db.security.addPermission \
    ( name       = 'Search'
    , klass      = 'issue'
    , properties = ('files', 'messages')
    )
db.security.addPermissionToRole ('User', p)

Ralf
-- 
Dr. Ralf Schlatterbeck                  Tel:   +43/2243/26465-16
Open Source Consulting                  www:   http://www.runtux.com
Reichergasse 131, A-3411 Weidling       email: [email protected]
allmenda.com member                     email: [email protected]

------------------------------------------------------------------------------
Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk