Attachment example on TracFineGrainedPermissions page is incorrect

[Ryan J Ollos]

There is an example on TracFineGrainedPermissions#UsageNotes which appears to be incorrect:

[wiki:WikiStart@*/attachment/*]
[wiki:WikiStart@117/attachment/FOO.JPG]

It appears that a forward-slash is used rather than a colon:

[wiki:WikiStart@*/attachment:*]
[wiki:WikiStart@117/attachment:FOO.JPG]

However, it also appears to be the case that the trailing @* is required for the case that the resource is specified:

[wiki:WikiStart@117/attachment:FOO.JPG@*]

The documentation states that it should be added implicitly, so this might be a defect.

I tested with attachment RepositoryBrowser.png on WikiStart, and found the following in the logs when viewing the attachment:

04:18:14 PM Trac[authz_policy] DEBUG: Checking ATTACHMENT_VIEW on wiki:WikiStart@*/attachment:RepositoryBrowser.png@*

The following policy prevents viewing the attachment:

[wiki:WikiStart@*/attachment:RepositoryBrowser.png@*]
* = !ATTACHMENT_VIEW

However, the policy doesn't work if the trailing @* is omitted.

[Jun Omae]

Replying to rjollos:

The following policy prevents viewing the attachment:

[wiki:WikiStart@*/attachment:RepositoryBrowser.png@*]
* = !ATTACHMENT_VIEW

However, the policy doesn't work if the trailing @* is omitted.

Currently, @* is automatically added to it only when a policy has no @ character. I think we could check like this.

tracopt/perm/authz_policy.py

@@ -17 +17 @@
 from fnmatch import fnmatchcase
 from itertools import groupby
 import os
+import re
 
 from trac.core import *
 from trac.config import ConfigurationError, Option
@@ -241 +242 @@
 
         return '/'.join(flatten(resource))
 
+    _resource_version_re = re.compile(r'@[^:/@]*\Z')
+
     def authz_permissions(self, resource_key, username):
         # TODO: Handle permission negation in sections. eg. "if in this
         # ticket, remove TICKET_MODIFY"
@@ -251 +254 @@
         for resource_section in [a for a in self.authz.sections
                                    if a != 'groups']:
             resource_glob = to_unicode(resource_section)
-            if '@' not in resource_glob:
+            if not self._resource_version_re.search(resource_glob):
                 resource_glob += '@*'
 
             if fnmatchcase(resource_key, resource_glob):

[Ryan J Ollos]

Replying to rjollos:

There is an example on TracFineGrainedPermissions#UsageNotes which appears to be incorrect:

[wiki:WikiStart@*/attachment/*]
[wiki:WikiStart@117/attachment/FOO.JPG]

Documentation fixed in wiki:TracFineGrainedPermissions?action=diff&version=52&old_version=50. I'll test the changes in comment:1 next.

[Jun Omae]

I noticed another issue while confirming this issue.

When latest version of WikiStart is 42 and authz policy has the following, it doesn't block for viewing /wiki/WikiStart. It block for viewing /wiki/WikiStart?version=42. I think that the policy should block it.

[wiki:WikiStart@42]
* = !WIKI_VIEW

[Ryan J Ollos]

Moved ticket assigned to next-stable-1.0.x since maintenance of 1.0.x is coming to a close. Please move the ticket back if it's critical to fix on 1.0.x.

[Ryan J Ollos]

Milestone renamed