Re: Restrict access of users to active issues

Hello:

In message <[email protected]>,
Christian Wolf writes:
> [...]
>What I added to schema.py:
>
>
>db.security.addRole(name='Vorstand',description='Vorstandsmitglied, kann
>alle Issues sehen')
>
>db.security.addPermissionToRole('Vorstand', 'Web Access')
>db.security.addPermissionToRole('Vorstand', 'Email Access')
>
>for cl in 'issue', 'file', 'msg', 'keyword':
>    db.security.addPermissionToRole('Vorstand', 'View', cl)
>    db.security.addPermissionToRole('Vorstand', 'Edit', cl)
>    db.security.addPermissionToRole('Vorstand', 'Create', cl)
>
>def on_nosy_list(db,userid,itemid):
>    ''' Checks if the user is on the nosy list of an issue '''
>    return userid in db.issue.get(itemid, 'nosy')
>
>p = db.security.addPermission(name='View', klass='issue',
>check=on_nosy_list, description='Can only view issues with nosy attribute')
>db.security.addPermissionToRole('User',p)
>p = db.security.addPermission(name='Edit', klass='issue',
>check=on_nosy_list, description='Can only edit issues with nosy attribute')
>db.security.addPermissionToRole('User',p)
>db.security.addPermissionToRole('User', 'Create', 'issue')
>
>
>Further I altered the following and removed the issue from the for list:
>
>
>for cl in 'file', 'msg', 'keyword':
>    db.security.addPermissionToRole('User', 'View', cl)
>    db.security.addPermissionToRole('User', 'Edit', cl)
>    db.security.addPermissionToRole('User', 'Create', cl)
>
>
>This leads to the desired effect, that a normal User does no more have
>access to issues where he is not on the nosy list. Nevertheless there is
>a side effect: When looking at the list of open issues, the grouping and
>sorting does not work. I cannot set any grouping neither using the
>selection boxes below the search result nor with the detailed search web
>interface.


This is a shot in the dark, but 

   http://roundup.sourceforge.net/docs/upgrading.html#migrating-from-1-4-x-to-1-4-17

Since you have read permission with a check method, I think you
need to add search permission.

Maybe you need:

  db.security.addPermissionToRole('User', 'Search', cl)

Good luck.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140