Changes between Version 10 and Version 11 of TracDev/SecurityBranch

Timestamp:

Dec 8, 2007, 11:07:17 PM (16 years ago)

Author:

osimons

Comment:

Updated the API examples to use new resource descriptors.

TracDev/SecurityBranch

@@ -54 +54 @@
 }}}
 
-New style:
+New style is based on adding a resource descriptor (`trac.resource.Resource`) as identification in permission checks:
 
 {{{
@@ -64 +64 @@
 # wish to restrict 'WikiStart' you must provide ('wiki', 'WikiStart').
 if 'WIKI_MODIFY' in req.perm('wiki', 'WikiStart', 20):
-        ...
+    ...
 
-# or, checking the current resource context
-if 'WIKI_MODIFY' in req.perm(context):
-        ...
+# A resource descriptor can be created and reused for the purpose.
+page_resource = Resource('wiki', 'WikiStart', 20)
+if 'WIKI_MODIFY' in req.perm(page_resource):
+    ...
 
 # Assert that user has permission
-req.perm.require('WIKI_MODIFY', 'wiki', 'WikiStart')
+req.perm(page_resource).require('WIKI_MODIFY')
 # or ...
-req.perm.require('WIKI_MODIFY', context)
+req.perm(page_resource).require('WIKI_MODIFY')
 }}}
 
@@ -83 +84 @@
 #!python
 class IPermissionPolicy(Interface):
-    """A security policy provider."""
-    def check_permission(username, action, context):
-        """Check that username can perform action in context.
+    """A security policy provider used for fine grained permission checks."""
 
-        Must return True if action is allowed, False if action is denied, or
-        None if indifferent."""
+    def check_permission(action, username, resource, perm):
+        """Check that the action can be performed by username on the resource
+        ...
 }}}
+
+See `trac.perm.IPermissionPolicy` source code for much more information.
 
 == Testing the features ==