Edgewall Software

Ticket #5640: 5640-hide-forbidden-messages-r7802.patch

File 5640-hide-forbidden-messages-r7802.patch, 4.7 KB (added by rblank, 3 years ago)

Patch against 0.11-stable hiding changeset info for which the user doesn't have view permission

  • trac/versioncontrol/templates/dir_entries.html

    diff --git a/trac/versioncontrol/templates/dir_entries.html b/trac/versioncontrol/templates/dir_entries.html
    a b  
    77  </py:if> 
    88  <py:for each="idx, entry in enumerate(dir.entries)"> 
    99    <py:with vars="change = dir.changes[entry.rev]"> 
    10       <tr class="${idx % 2 and 'even' or 'odd'}"> 
     10      <tr class="${idx % 2 and 'even' or 'odd'}" py:with="chgset_context = context('changeset', change.rev); 
     11                                                          allowed = change and 'CHANGESET_VIEW' in perm(chgset_context.resource)  
     12                                                                    and any(change.get_changes())"> 
    1113        <td class="name"> 
    1214          <a class="$entry.kind" title="View ${entry.kind.capitalize()}" 
    1315             href="${href.browser(entry.path, rev=stickyrev, order=(dir.order != 'name' and dir.order or None), desc=dir.desc)}">$entry.name</a> 
     
    1618        <td class="rev"> 
    1719          <a title="View Revision Log" href="${href.log(entry.path, rev=rev)}">$entry.rev</a> 
    1820        </td> 
    19         <td class="age" style="${change and dir.timerange and 'border-color: rgb(%s,%s,%s)' % 
     21        <td class="age" style="${allowed and dir.timerange and 'border-color: rgb(%s,%s,%s)' % 
    2022          dir.colorize_age(dir.timerange.relative(change.date)) or None}"> 
    21           ${change and dateinfo(change.date) or '-'} 
     23          ${allowed and dateinfo(change.date) or None} 
    2224        </td> 
    2325        <td class="change"> 
    24           <span class="author" py:if="change">${authorinfo(change.author)}:</span> 
    25           <span class="change" py:choose="" py:with="chgset_context = context('changeset', change.rev)"> 
    26             <py:when test="not change or 'CHANGESET_VIEW' not in perm(chgset_context.resource)">-</py:when> 
     26          <span class="author" py:if="allowed">${authorinfo(change.author)}:</span> 
     27          <span class="change" py:choose=""> 
     28            <py:when test="not allowed"></py:when> 
    2729            <py:when test="wiki_format_messages"> 
    28               ${change and wiki_to_oneliner(chgset_context, change.message, shorten=True)} 
     30              ${wiki_to_oneliner(chgset_context, change.message, shorten=True)} 
    2931            </py:when> 
    30             <py:otherwise>${change and shorten_line(change.message)}</py:otherwise> 
     32            <py:otherwise>${shorten_line(change.message)}</py:otherwise> 
    3133          </span> 
    3234        </td> 
    3335      </tr> 
  • trac/versioncontrol/templates/revisionlog.html

    diff --git a/trac/versioncontrol/templates/revisionlog.html b/trac/versioncontrol/templates/revisionlog.html
    a b  
    108108            <py:for each="idx, item in enumerate(items)"> 
    109109              <py:with vars="change = changes[item.rev]; 
    110110                             chgset_context = context('changeset', change.rev); 
    111                              odd_even = idx % 2 and 'odd' or 'even'"> 
     111                             odd_even = idx % 2 and 'odd' or 'even'; 
     112                             allowed = 'CHANGESET_VIEW' in perm(chgset_context.resource) and any(change.get_changes())"> 
    112113                <!--! highlight copy or rename operations --> 
    113114                <tr py:if="item.change and item.get('copyfrom_path')" class="$odd_even"> 
    114115                  <td /> 
     
    139140                      <a title="View changeset [$item.rev] for $item.path" href="${href.changeset(item.rev, item.path)}"> 
    140141                        [$item.rev]</a> 
    141142                    </td> 
    142                     <td class="date" py:content="dateinfo(change.date)" /> 
    143                     <td class="author" py:content="authorinfo(change.author)" /> 
     143                    <td class="date" py:content="allowed and dateinfo(change.date) or ''" /> 
     144                    <td class="author" py:content="allowed and authorinfo(change.author) or ''" /> 
    144145                    <td class="summary" py:choose=""> 
    145                       <py:when test="verbose or 'CHANGESET_VIEW' not in perm(chgset_context.resource)"></py:when> 
     146                      <py:when test="verbose or not allowed"></py:when> 
    146147                      <py:when test="wiki_format_messages"> 
    147148                        ${wiki_to_oneliner(chgset_context, change.message, shorten=True)} 
    148149                      </py:when> 
     
    154155 
    155156                <tr py:if="verbose" class="$odd_even verbose"> 
    156157                  <td class="summary" colspan="6" py:choose="" xml:space="preserve"> 
     158                    <py:when test="not allowed"></py:when> 
    157159                    <py:when test="wiki_format_messages"> 
    158160                      ${wiki_to_html(chgset_context, change.message, escape_newlines=True)} 
    159161                    </py:when>