Re: msg permissions issue

PS - I checked /usr/bin/python3 and it's python 3.7.3

thanks for any advice.  perhaps I should migrate to the newest roundup
for enhanced permission control?

On Thu, Oct 5, 2023 at 8:58 PM Chuck Cunningham
<[email protected]> wrote:
>
> Thanks John,
>
> It's Roundup 2.0.0 and it seems /usr/bin/python3 is being called in
> roundup-server etc.
>
> On Thu, Oct 5, 2023 at 8:04 PM John P. Rouillard <[email protected]> wrote:
> >
> > Hi Chuck:
> >
> > What version of Roundup are you running? What version of Python?
> >
> > In message
> > <CAH-41398iTPhze7D_pZB8tqTBHF=q6HYonbcG++YN-ioDssXBw@mail.gmail.com>,
> > Chuck Cunningham writes:
> > >I have my tracker set up so that users only see issues they create or
> > >assigned to them by doing this:
> > >
> > >def user_issue(db, userid, itemid):
> > >    return userid == db.issue.get(itemid, 'assignedto') or userid ==
> > >db.issue.get(itemid, 'creator')
> >
> > I don't think you need this check. It should be a subset of the nosy
> > list permission check. The creator and assignedto people should be on
> > the nosy list. Also depending on the ticket, you might want to exclude
> > the creator. In a tracker I built, I use the nosy list (and a
> > 'verynosy') as ACL's for access to the files and msg as well as the
> > issue.  (See:
> > https://rouilj.dynamic-dns.net/fossil/roundup_sysadmin/file?name=schema.py&ci=tip
> > for the (messy) schema.)
> >
> > >p = db.security.addPermission(name='View', klass='issue',
> > >    check=user_issue,description="User is allowed to access this")
> > >db.security.addPermissionToRole('User', p)
> > >p = db.security.addPermission(name='Edit', klass='issue',
> > >    check=user_issue,description="User is allowed to edit this")
> > >db.security.addPermissionToRole('User', p)
> > >db.security.addPermissionToRole('User', 'Create', 'issue')
> > >
> > >for cl in 'file', 'msg':
> > >    db.security.addPermissionToRole('User', 'View', cl)
> > >    db.security.addPermissionToRole('User', 'Edit', cl)
> > >    db.security.addPermissionToRole('User', 'Create', cl)
> >
> > This should allow every person with the User role to create/edit/view
> > any msg or file. Note that this set of permissions doesn't restrict
> > access to an individual msg or file.
> >
> > >I then wanted to make it so that users also see issues for which they
> > >are on the nosy list:
> > >
> > >def user_nosy_issue(db, userid, itemid):
> > >    nosy = db.issue.get(itemid, 'nosy')
> > >    # check if userid is in the list and return 1 if yes, 0 otherwise
> > >    return nosy.count(userid)
> >
> > Although 'return userid in nosy' is more idiomatic, this should
> > work. Using count() is less efficient though. Count has to visit each
> > value in the nosy array to count all matching values. It doesn't stop
> > once it finds a match.
> >
> > I'm trying to remember if the nosy value is a list of strings or
> > integers. I think userid and the items in the nosy list are both
> > strings. So your code should work as expected.
> >
> > I raise this because:
> >
> >     nosy = ['1', '2', '3']
> >     c = nosy.count(1)
> >
> > c will be 0.
> >
> >     c = nosy.count('1')
> >
> > c will be 1. Also vice versa.
> >
> > ># add permission for issue view and edit for people on nosy list
> > >p = db.security.addPermission(name='View', klass='issue',
> > >    check=user_nosy_issue, description="User is allowed to access this")
> > >db.security.addPermissionToRole('User', p)
> > >p = db.security.addPermission(name='Edit', klass='issue',
> > >    check=user_nosy_issue,description="User is allowed to edit this")
> > >db.security.addPermissionToRole('User', p)
> >
> > I suggest changing your descriptions to include nosy somehow. E.G.
> >
> >   description="User is allowed to access this (on nosy list)"
> >
> > >This works great except people on the nosy list can't reply (and
> > >create a 'msg')..I know there is something I need to do to the
> > >permissions for messages, but can't figure it out.  Any pointers much
> > >appreciated.
> >
> > Your msg permissions look like you are allowing Create, so I am also
> > bewildered.
> >
> > What does running:
> >
> >    roundup-admin -i <tracker/home/dir> security user
> >
> > report? (note: internally role names are all lowercase hence 'user'
> > not 'User'., This is also a bug and will be fixed to lowercase the
> > role string.)
> >
> > Have a great day.
> > --
> >                                 -- rouilj
> > John Rouillard
> > ===========================================================================
> > My employers don't acknowledge my existence much less my opinions.


_______________________________________________
Roundup-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/roundup-users