Re: Restrict access of users to active issues

Hello,

OK, unfortunately I did not get any answers, so I went through the code
a bit and found at least a way to lock me out (as a test case).

What I added to schema.py:


db.security.addRole(name='Vorstand',description='Vorstandsmitglied, kann
alle Issues sehen')

db.security.addPermissionToRole('Vorstand', 'Web Access')
db.security.addPermissionToRole('Vorstand', 'Email Access')

for cl in 'issue', 'file', 'msg', 'keyword':
    db.security.addPermissionToRole('Vorstand', 'View', cl)
    db.security.addPermissionToRole('Vorstand', 'Edit', cl)
    db.security.addPermissionToRole('Vorstand', 'Create', cl)

def on_nosy_list(db,userid,itemid):
    ''' Checks if the user is on the nosy list of an issue '''
    return userid in db.issue.get(itemid, 'nosy')

p = db.security.addPermission(name='View', klass='issue',
check=on_nosy_list, description='Can only view issues with nosy attribute')
db.security.addPermissionToRole('User',p)
p = db.security.addPermission(name='Edit', klass='issue',
check=on_nosy_list, description='Can only edit issues with nosy attribute')
db.security.addPermissionToRole('User',p)
db.security.addPermissionToRole('User', 'Create', 'issue')


Further I altered the following and removed the issue from the for list:


for cl in 'file', 'msg', 'keyword':
    db.security.addPermissionToRole('User', 'View', cl)
    db.security.addPermissionToRole('User', 'Edit', cl)
    db.security.addPermissionToRole('User', 'Create', cl)


This leads to the desired effect, that a normal User does no more have
access to issues where he is not on the nosy list. Nevertheless there is
a side effect: When looking at the list of open issues, the grouping and
sorting does not work. I cannot set any grouping neither using the
selection boxes below the search result nor with the detailed search web
interface.

Maybe someone might know if this has with my altered issues to do.

Thanks a lot
Christian

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140