Changes between Version 14 and Version 15 of CookBook/PermissionPolicies

Timestamp:

May 10, 2017, 10:43:51 AM (7 years ago)

Author:

Ryan J Ollos

Comment:

Update permission policy so that search filter is present.

CookBook/PermissionPolicies

@@ -174 +174 @@
         if username != 'anonymous' and \
                 action == 'TICKET_VIEW' and \
-                resource is not None and \
-                resource.realm == 'ticket' and \
-                resource.id is not None and \
-                'TICKET_VIEW_REPORTED' in perm:
-            try:
-                ticket = Ticket(self.env, resource.id)
-            except ResourceNotFound:
-                pass
-            else:
-                return ticket['reporter'] == username
+                'TICKET_ADMIN' not in perm:
+            if 'TICKET_VIEW_REPORTED' in perm:
+                if resource is None or \
+                        resource.realm == 'ticket' and \
+                        resource.id is None:
+                    return True
+                elif resource.realm == 'ticket' and \
+                        resource.id is not None:
+                    try:
+                        ticket = Ticket(self.env, resource.id)
+                    except ResourceNotFound:
+                        pass
+                    else:
+                        return username in (ticket['reporter'], ticket['owner'])
+
 }}}
 1. Edit the `permission_policies` option in the [TracIni#trac-section "[trac]"] section of trac.ini, adding the `SupportDeskPolicy` component ''before'' the default [TracPermissions permission] policy:
@@ -190 +195 @@
  permission_policies = SupportDeskPolicy, ...
 }}}
-1. Revoke `TICKET_VIEW` and grant `TICKET_VIEW_REPORTED` for users that should only view tickets they reported.
+1. Revoke `TICKET_VIEW` and grant `TICKET_VIEW_REPORTED` for users that should only view tickets they reported. Users with `TICKET_VIEW` can view all tickets, provided they don't also have `TICKET_VIEW_REPORTED`.
 1. Grant other permissions such as `TICKET_CHGPROP`, `TICKET_APPEND` or `TICKET_MODIFY`. Users can only change tickets they can view, therefore you'll only be granting these permissions for tickets the user reported.