source code still accessible even when permissions turned off

[trac@…]

I was seeing if Trac would work for a business project. I linked it with my subversion repository, and removed the anonymous user ability to view the source code in order to protect it. However, I grabbed the url to the source code viewer page while logged in, then logged out and used that link, and it allowed me to view it. I think that this should not be allowed.

[Matthew Good]

Directly accessing a URL does not circumvent the permissions checking, but you were probably mistaken about the effect of the assigned permissions. Access to source files is based on the FILE_VIEW permission. If you happened to remove just BROWSER_VIEW the user would be unable to browse the directories, but accessing a specific file would be permitted.