Re: msg permissions issue

Hi John,

From trying to answer your questions I actually discovered the reason
for my problem - the tracker was actually working exactly as it
should, I just had messages_to_author set to "no" in config.ini, and
that made me erroneously think that email weren't being sent.
Previously, I had been doing everything under the admin account, but
when I added my user_nosy_issue() check, I started using a regular
"User" account and mistakenly thought msg creation was broken.  i
still provided all the output requested below, for completeness and in
case you have any other advice.

Thanks again,

Charles

On Fri, Oct 6, 2023 at 8:44 AM Chuck Cunningham
<[email protected]> wrote:
>
> PS - I checked /usr/bin/python3 and it's python 3.7.3
>
> thanks for any advice.  perhaps I should migrate to the newest roundup
> for enhanced permission control?
>
> On Thu, Oct 5, 2023 at 8:58 PM Chuck Cunningham
> <[email protected]> wrote:
> >
> > Thanks John,
> >
> > It's Roundup 2.0.0 and it seems /usr/bin/python3 is being called in
> > roundup-server etc.
> >
> > On Thu, Oct 5, 2023 at 8:04 PM John P. Rouillard <[email protected]> wrote:
> > >
> > > Hi Chuck:
> > >
> > > What version of Roundup are you running? What version of Python?

Roundup 2.0.0 and python 3.7.3

> > >
> > > In message
> > > <CAH-41398iTPhze7D_pZB8tqTBHF=q6HYonbcG++YN-ioDssXBw@mail.gmail.com>,
> > > Chuck Cunningham writes:
> > > >I have my tracker set up so that users only see issues they create or
> > > >assigned to them by doing this:
> > > >
> > > >def user_issue(db, userid, itemid):
> > > >    return userid == db.issue.get(itemid, 'assignedto') or userid ==
> > > >db.issue.get(itemid, 'creator')
> > >
> > > I don't think you need this check. It should be a subset of the nosy
> > > list permission check. The creator and assignedto people should be on
> > > the nosy list. Also depending on the ticket, you might want to exclude
> > > the creator. In a tracker I built, I use the nosy list (and a
> > > 'verynosy') as ACL's for access to the files and msg as well as the
> > > issue.  (See:
> > > https://rouilj.dynamic-dns.net/fossil/roundup_sysadmin/file?name=schema.py&ci=tip
> > > for the (messy) schema.)

Thanks very much, I'll definitely check out your schema and maybe I
can adapt.  I added the user_issue() check so that users only see
their own issues

> > >
> > > >p = db.security.addPermission(name='View', klass='issue',
> > > >    check=user_issue,description="User is allowed to access this")
> > > >db.security.addPermissionToRole('User', p)
> > > >p = db.security.addPermission(name='Edit', klass='issue',
> > > >    check=user_issue,description="User is allowed to edit this")
> > > >db.security.addPermissionToRole('User', p)
> > > >db.security.addPermissionToRole('User', 'Create', 'issue')
> > > >
> > > >for cl in 'file', 'msg':
> > > >    db.security.addPermissionToRole('User', 'View', cl)
> > > >    db.security.addPermissionToRole('User', 'Edit', cl)
> > > >    db.security.addPermissionToRole('User', 'Create', cl)
> > >
> > > This should allow every person with the User role to create/edit/view
> > > any msg or file. Note that this set of permissions doesn't restrict
> > > access to an individual msg or file.

Yeah, I did this at the time of adding the user_issue() check because
I couldn't figure out how to do the equivalent for 'file' and 'msg'
and figured I didn't need super high security, so giving 'User' access
to all files and messsages seemed ok.

> > >
> > > >I then wanted to make it so that users also see issues for which they
> > > >are on the nosy list:
> > > >
> > > >def user_nosy_issue(db, userid, itemid):
> > > >    nosy = db.issue.get(itemid, 'nosy')
> > > >    # check if userid is in the list and return 1 if yes, 0 otherwise
> > > >    return nosy.count(userid)
> > >
> > > Although 'return userid in nosy' is more idiomatic, this should
> > > work. Using count() is less efficient though. Count has to visit each
> > > value in the nosy array to count all matching values. It doesn't stop
> > > once it finds a match.
> > >
> > > I'm trying to remember if the nosy value is a list of strings or
> > > integers. I think userid and the items in the nosy list are both
> > > strings. So your code should work as expected.
> > >
> > > I raise this because:
> > >
> > >     nosy = ['1', '2', '3']
> > >     c = nosy.count(1)
> > >
> > > c will be 0.
> > >
> > >     c = nosy.count('1')
> > >
> > > c will be 1. Also vice versa.
> > >
> > > ># add permission for issue view and edit for people on nosy list
> > > >p = db.security.addPermission(name='View', klass='issue',
> > > >    check=user_nosy_issue, description="User is allowed to access this")
> > > >db.security.addPermissionToRole('User', p)
> > > >p = db.security.addPermission(name='Edit', klass='issue',
> > > >    check=user_nosy_issue,description="User is allowed to edit this")
> > > >db.security.addPermissionToRole('User', p)
> > >
> > > I suggest changing your descriptions to include nosy somehow. E.G.
> > >
> > >   description="User is allowed to access this (on nosy list)"
> > >

will do that now so that the output below is better


> > > >This works great except people on the nosy list can't reply (and
> > > >create a 'msg')..I know there is something I need to do to the
> > > >permissions for messages, but can't figure it out.  Any pointers much
> > > >appreciated.
> > >
> > > Your msg permissions look like you are allowing Create, so I am also
> > > bewildered.
> > >
> > > What does running:
> > >
> > >    roundup-admin -i <tracker/home/dir> security user
> > >
> > > report? (note: internally role names are all lowercase hence 'user'
> > > not 'User'., This is also a bug and will be fixed to lowercase the
> > > role string.)

Role "user":
User may access the web interface (Web Access)
User may use the email interface (Email Access)
User may access the rest interface (Rest Access)
User may access the xmlrpc interface (Xmlrpc Access)
User is allowed to access this (View for "issue" only)
User is allowed to edit this (Edit for "issue" only)
User is allowed to create issue (Create for "issue" only)
User is allowed to access file (View for "file" only)
User is allowed to edit file (Edit for "file" only)
User is allowed to create file (Create for "file" only)
User is allowed to access msg (View for "msg" only)
User is allowed to edit msg (Edit for "msg" only)
User is allowed to create msg (Create for "msg" only)
User is allowed to access priority (View for "priority" only)
User is allowed to access status (View for "status" only)
Users is allowed to access issue Search (Search for "issue" only)
User is allowed to access this (on the nosy list) (View for "issue" only)
User is allowed to edit this (on the nosy list) (Edit for "issue" only)
User is allowed to access this (on the nosy list) (View for "msg" only)
User is allowed to edit this (on the nosy list) (Edit for "msg" only)
User is allowed to create this (on the nosy list) (Edit for "msg" only)
(View for "user": ('id', 'organisation', 'phone', 'realname',
'timezone', 'username') only)
User is allowed to view their own user details (View for "user" only)
User is allowed to edit their own user details (Edit for "user":
('username', 'password', 'address', 'realname', 'phone',
'organisation', 'alternate_addresses', 'queries', 'timezone') only)
User is allowed to view their own and public queries (View for "query" only)
 (Search for "query" only)
User is allowed to edit their queries (Edit for "query" only)
User is allowed to retire their queries (Retire for "query" only)
User is allowed to restore their queries (Restore for "query" only)
User is allowed to create queries (Create for "query" only)




> > >
> > > Have a great day.
> > > --
> > >                                 -- rouilj
> > > John Rouillard
> > > ===========================================================================
> > > My employers don't acknowledge my existence much less my opinions.


_______________________________________________
Roundup-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/roundup-users