Re: msg permissions issue

Thanks John,

It's Roundup 2.0.0 and it seems /usr/bin/python3 is being called in
roundup-server etc.

On Thu, Oct 5, 2023 at 8:04 PM John P. Rouillard <[email protected]> wrote:
>
> Hi Chuck:
>
> What version of Roundup are you running? What version of Python?
>
> In message
> <CAH-41398iTPhze7D_pZB8tqTBHF=q6HYonbcG++YN-ioDssXBw@mail.gmail.com>,
> Chuck Cunningham writes:
> >I have my tracker set up so that users only see issues they create or
> >assigned to them by doing this:
> >
> >def user_issue(db, userid, itemid):
> >    return userid == db.issue.get(itemid, 'assignedto') or userid ==
> >db.issue.get(itemid, 'creator')
>
> I don't think you need this check. It should be a subset of the nosy
> list permission check. The creator and assignedto people should be on
> the nosy list. Also depending on the ticket, you might want to exclude
> the creator. In a tracker I built, I use the nosy list (and a
> 'verynosy') as ACL's for access to the files and msg as well as the
> issue.  (See:
> https://rouilj.dynamic-dns.net/fossil/roundup_sysadmin/file?name=schema.py&ci=tip
> for the (messy) schema.)
>
> >p = db.security.addPermission(name='View', klass='issue',
> >    check=user_issue,description="User is allowed to access this")
> >db.security.addPermissionToRole('User', p)
> >p = db.security.addPermission(name='Edit', klass='issue',
> >    check=user_issue,description="User is allowed to edit this")
> >db.security.addPermissionToRole('User', p)
> >db.security.addPermissionToRole('User', 'Create', 'issue')
> >
> >for cl in 'file', 'msg':
> >    db.security.addPermissionToRole('User', 'View', cl)
> >    db.security.addPermissionToRole('User', 'Edit', cl)
> >    db.security.addPermissionToRole('User', 'Create', cl)
>
> This should allow every person with the User role to create/edit/view
> any msg or file. Note that this set of permissions doesn't restrict
> access to an individual msg or file.
>
> >I then wanted to make it so that users also see issues for which they
> >are on the nosy list:
> >
> >def user_nosy_issue(db, userid, itemid):
> >    nosy = db.issue.get(itemid, 'nosy')
> >    # check if userid is in the list and return 1 if yes, 0 otherwise
> >    return nosy.count(userid)
>
> Although 'return userid in nosy' is more idiomatic, this should
> work. Using count() is less efficient though. Count has to visit each
> value in the nosy array to count all matching values. It doesn't stop
> once it finds a match.
>
> I'm trying to remember if the nosy value is a list of strings or
> integers. I think userid and the items in the nosy list are both
> strings. So your code should work as expected.
>
> I raise this because:
>
>     nosy = ['1', '2', '3']
>     c = nosy.count(1)
>
> c will be 0.
>
>     c = nosy.count('1')
>
> c will be 1. Also vice versa.
>
> ># add permission for issue view and edit for people on nosy list
> >p = db.security.addPermission(name='View', klass='issue',
> >    check=user_nosy_issue, description="User is allowed to access this")
> >db.security.addPermissionToRole('User', p)
> >p = db.security.addPermission(name='Edit', klass='issue',
> >    check=user_nosy_issue,description="User is allowed to edit this")
> >db.security.addPermissionToRole('User', p)
>
> I suggest changing your descriptions to include nosy somehow. E.G.
>
>   description="User is allowed to access this (on nosy list)"
>
> >This works great except people on the nosy list can't reply (and
> >create a 'msg')..I know there is something I need to do to the
> >permissions for messages, but can't figure it out.  Any pointers much
> >appreciated.
>
> Your msg permissions look like you are allowing Create, so I am also
> bewildered.
>
> What does running:
>
>    roundup-admin -i <tracker/home/dir> security user
>
> report? (note: internally role names are all lowercase hence 'user'
> not 'User'., This is also a bug and will be fixed to lowercase the
> role string.)
>
> Have a great day.
> --
>                                 -- rouilj
> John Rouillard
> ===========================================================================
> My employers don't acknowledge my existence much less my opinions.


_______________________________________________
Roundup-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/roundup-users