Re: msg permissions issue

Hi Chuck:

In message
<CAH-41380E27xYayDQNCp8XyVR377LQBYSG=A+CZmvo4GBsXRnA@mail.gmail.com> ,
Chuck Cunningham writes:
>>From trying to answer your questions I actually discovered the reason
>for my problem - the tracker was actually working exactly as it
>should, I just had messages_to_author set to "no" in config.ini, and
>that made me erroneously think that email weren't being sent.

I'm glad you found that. As I said I was baffled how your
config wouldn't work.

>Previously, I had been doing everything under the admin account, but
>when I added my user_nosy_issue() check, I started using a regular
>"User" account and mistakenly thought msg creation was broken.

Got it. Is there something that would have helped you arrive at this
conclusion earlier?

>On Fri, Oct 6, 2023 at 8:44 AM Chuck Cunningham
><[email protected]> wrote:
>> > It's Roundup 2.0.0 and it seems /usr/bin/python3 is being called in
>> > roundup-server etc.
>> thanks for any advice.  perhaps I should migrate to the newest roundup
>> for enhanced permission control?

2.3.0 does have a number of improvements, but I don't think there is
any change to permissions for your use case.

One thing I would suggest from a security perspective is to increase
the number of password_pbkdf2_default_rounds. If you read the current
upgrading guide on the web site it will talk you through some
considerations. For your version you are using the SHA1 version of
PBKDF.

https://www.roundup-tracker.org/docs/upgrading.html#update-config-ini-s-password-pbkdf2-default-rounds-required


>> > > >for cl in 'file', 'msg':
>> > > >    db.security.addPermissionToRole('User', 'View', cl)
>> > > >    db.security.addPermissionToRole('User', 'Edit', cl)
>> > > >    db.security.addPermissionToRole('User', 'Create', cl)
>> > >
>> > > This should allow every person with the User role to create/edit/view
>> > > any msg or file. Note that this set of permissions doesn't restrict
>> > > access to an individual msg or file.
>
>Yeah, I did this at the time of adding the user_issue() check because
>I couldn't figure out how to do the equivalent for 'file' and 'msg'
>and figured I didn't need super high security, so giving 'User' access
>to all files and messsages seemed ok.

That's a valid assessment.  It's sort of like having an implicit:

   createdby me or assignedto me or I am nosy

on their searches. It can help in keeping users from getting
overwhelmed by issues when they search.

If you are interested look at msg_access in

   https://rouilj.dynamic-dns.net/fossil/roundup_sysadmin/file?name=schema.py&ci=tip

to see how I restrict msg access if an issue is restricted access.  I
think there is also a file_access as well.

>> > > >This works great except people on the nosy list can't reply (and
>> > > >create a 'msg')..I know there is something I need to do to the
>> > > >permissions for messages, but can't figure it out.  Any pointers much
>> > > >appreciated.
>> > >
>> > > Your msg permissions look like you are allowing Create, so I am also
>> > > bewildered.
>> > >
>> > > What does running:
>> > >
>> > >    roundup-admin -i <tracker/home/dir> security user
>> > >
>> > > report? (note: internally role names are all lowercase hence 'user'
>> > > not 'User'., This is also a bug and will be fixed to lowercase the
>> > > role string.)

I fixed the bug so 2.4.0 will accept User, user, UsER etc. and display
the "user" role.

>Role "user":
>User may access the web interface (Web Access)
>User may use the email interface (Email Access)
>User may access the rest interface (Rest Access)
>User may access the xmlrpc interface (Xmlrpc Access)
>User is allowed to access this (View for "issue" only)
>User is allowed to edit this (Edit for "issue" only)
>User is allowed to create issue (Create for "issue" only)
>User is allowed to access file (View for "file" only)
>User is allowed to edit file (Edit for "file" only)
>User is allowed to create file (Create for "file" only)
>User is allowed to access msg (View for "msg" only)
>User is allowed to edit msg (Edit for "msg" only)
>User is allowed to create msg (Create for "msg" only)
>User is allowed to access priority (View for "priority" only)
>User is allowed to access status (View for "status" only)
>Users is allowed to access issue Search (Search for "issue" only)
>User is allowed to access this (on the nosy list) (View for "issue" only)
>User is allowed to edit this (on the nosy list) (Edit for "issue" only)
>User is allowed to access this (on the nosy list) (View for "msg" only)
>User is allowed to edit this (on the nosy list) (Edit for "msg" only)
>User is allowed to create this (on the nosy list) (Edit for "msg" only)
>(View for "user": ('id', 'organisation', 'phone', 'realname',
>'timezone', 'username') only)
>User is allowed to view their own user details (View for "user" only)
>User is allowed to edit their own user details (Edit for "user":
>('username', 'password', 'address', 'realname', 'phone',
>'organisation', 'alternate_addresses', 'queries', 'timezone') only)
>User is allowed to view their own and public queries (View for "query" only)
> (Search for "query" only)
>User is allowed to edit their queries (Edit for "query" only)
>User is allowed to retire their queries (Retire for "query" only)
>User is allowed to restore their queries (Restore for "query" only)
>User is allowed to create queries (Create for "query" only)

Yup that looks like what I expected to see. So nothing to see here,
let's move along 8-).

>Thanks again,

You're welcome. I hope you enjoy using Roundup. If you are on GitHub,
I would apreciate it if you would star the repo.

    https://github.com/roundup-tracker/roundup

Also if you don't mind, I would like to know how you intend to use
Roundup?

   Is it a help desk/IT role or bug/development or some other role?

   Is it company wide or just for a local group?

   How many people are going to use it?

   How large is your company, < 50 employees, < 100, < 500, < 1000 > 1000

   Is it internal or external facing at your company?

Have a great week and I am glad your problem is solved.

--
rouilj John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.


_______________________________________________
Roundup-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/roundup-users