Ticket #7116: trac-browser-fine-grained-security-for-directories.2.patch

trac/versioncontrol/web_ui/browser.py

@@ -27 +27 @@
 from trac.core import *
 from trac.mimeview.api import Mimeview, is_binary, get_mimetype, \
                               IHTMLPreviewAnnotator, Context
-from trac.perm import IPermissionRequestor
+from trac.perm import IPermissionRequestor, PermissionError
 from trac.resource import ResourceNotFound, Resource
 from trac.util import sorted, embedded_numbers
 from trac.util.datefmt import http_date, utc
@@ -358 +358 @@
             'properties': xhr or self.render_properties('browser', context,
                                                         node.get_properties()),
             'path_links': path_links,
-            'dir': node.isdir and self._render_dir(req, repos, node, rev),
+            'dir': node.isdir and self._render_dir(req, context, repos,
+                                                   node, rev),
             'file': node.isfile and self._render_file(req, context, repos,
                                                       node, rev),
             'quickjump_entries': xhr or list(repos.get_quickjump_entries(rev)),
@@ -394 +395 @@
 
     # Internal methods
 
-    def _render_dir(self, req, repos, node, rev=None):
-        req.perm.require('BROWSER_VIEW')
+    def _render_dir(self, req, context, repos, node, rev=None):
+        req.perm(context.resource).require('BROWSER_VIEW')
 
         # Entries metadata
         class entry(object):
@@ -403 +404 @@
             def __init__(self, node):
                 for f in entry.__slots__:
                     setattr(self, f, getattr(n, f))
-                
-        entries = [entry(n) for n in node.get_entries()]
+                    
+        def test_perm_for_entry(n):
+            resource = Context.from_request(req,
+                                            context.resource.realm,
+                                            n.path,
+                                            n.created_rev).resource
+            try:
+                req.perm(resource).require('BROWSER_VIEW')
+            except PermissionError:
+                return False
+            return True
+            
+        entries = [entry(n)
+                   for n in node.get_entries()
+                   if test_perm_for_entry(n)
+                   ]
         changes = get_changes(repos, [i.rev for i in entries])
 
         if rev: