Allow custom queries to be saved without granting REPORT_CREATE
|Reported by:||Owned by:|
Description (last modified by )
In order to save a ticket query the user must have
REPORT_CREATE and the
ReportModule must be enabled. In the documentation, TracReports#TracReports, the user is "encouraged" to try the configuration with the
ReportModule disabled. However, this will remove the ability to save queries. On the other hand, granting
REPORT_CREATE allows the user to write SQL in a report, and inspect tables that you may not wish them to access (gmessage:trac-users:J23IZuJddzA/3clXkEJBAAAJ). Simple example:
SELECT sid,value FROM session_attribute WHERE name='email';
We should at least allow the user to save a query without also having the ability to create a report with SQL.
ReportModule, we may want to consider limiting the tables that a user can access with
REPORT_ADMIN could continue to access all tables.
Copied from 9982#comment:10:
One possible improvement would be to add a setting for disabling the creation and editing of SQL reports, which are the ones with the drawbacks mentioned in the TracReports page. The list of reports, the wiki syntax and the possibility to saves and edit the non-SQL queries would continue to work.
Copied from [ticket:9982#comment:13:
I think we can make a generic trac.report module, with the usual api/model/web_ui files. The details of handling and rendering legacy SQL reports could stay in source:trunk/trac/ticket/report.py and source:trunk/trac/ticket/templates/
That way, it will be easy to disable trac.ticket.report.* and still have the report list of saved custom queries.