Re: Permission issue

Hello Chuck:

Welcome to Roundup I'm sorry your are having problems, but I may have
a solution.

In message
<CAH-41388SWAGShnEKUuEuZs727f2yCkd4=-nVejkFcCoHhQ3uA@mail.gmail.com> ,
Chuck Cunningham writes:
>I've been trying to implement this customization below, from
>https://www.roundup-tracker.org/docs/customizing.html#examples
>
>It works nicely except for one thing - the dropdowns for "Sort on" and
>'Group on" on the webpage become empty when I put this into schema.py, and
>I can't sort or group when logged in (although anonymous still has the
>dropdowns)...

My guess is Anonymous has View access on the issues as well. Is this
correct? If you run 'roundup-admin -i <tracker dir> security'

>It seems like a permission issue, but I can't figure out what
>permission controls those dropdowns...any advice would be appreciated!

I'll bet it's the Search permission that was added after that example
was created.

>All users may only view and edit issues, files and messages they create
><https://www.roundup-tracker.org/docs/customizing.html#id126>
>
>Replace the standard “classic” tracker View and Edit Permission assignments
>for the “issue”, “file” and “msg” classes with the following:

Please change the code by ading description parameter (optional)
and the two last lines:


def checker(klass):
    def check(db, userid, itemid, klass=klass):
        return db.getclass(klass).get(itemid, 'creator') == userid
    return checkfor cl in 'issue', 'file', 'msg':
    p = db.security.addPermission(name='View', klass=cl,
        check=checker(cl), description='User can view only if creator.')
    db.security.addPermissionToRole('User', p)
    p = db.security.addPermission(name='Edit', klass=cl,
        check=checker(cl), description='User can edit only if creator.')
    db.security.addPermissionToRole('User', p)
    db.security.addPermissionToRole('User', 'Create', cl)
# add the two lines below
p = db.security.addPermission(name='Search', klass='issue')
db.security.addPermissionToRole('User', p)

This adds the Search permission to the user role. By default the
search permission is implied by the View permission. If the view
permission denies access to the class in general (which this check
command does), the Search permission is added to allow viewing of the
properties of the class. The description lines are displayed when you
run the security command for roundup-admin. Makes it a little clearer
that it's not normal view/edit permissions.

The 'Users may only edit their issues' example with the Provisional
User demonstrates adding the Search permission. That example includes:

    # This allows the interface to get the names of the properties
    # in the issue. Used for selecting sorting and grouping
    # on the index page.
    p = db.security.addPermission(name='Search', klass='issue')
    db.security.addPermissionToRole ('Provisional User', p)

This example also uses the description parameter.

If this change solves your issue, I'll update the example to include
Search perms.

Hope this helps. Have a great day and stay safe.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.


_______________________________________________
Roundup-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/roundup-users