Changes between Version 46 and Version 47 of TracFineGrainedPermissions

Timestamp:

Oct 10, 2013, 7:37:56 AM (11 years ago)

Author:

Peter Suter

Comment:

Slight reordering of ReadonlyWikiPolicy infos

TracFineGrainedPermissions

@@ -17 +17 @@
 {{{
 [trac]
-permission_policies = AuthzSourcePolicy, DefaultPermissionPolicy, LegacyAttachmentPolicy
-}}}
-This lists the [#AuthzSourcePolicy] described below as the first policy, followed by the !DefaultPermissionPolicy which checks for the traditional coarse grained style permissions described in TracPermissions, and the !LegacyAttachmentPolicy which knows how to use the coarse grained permissions for checking the permissions available on attachments.
+permission_policies = ReadonlyWikiPolicy, DefaultPermissionPolicy, LegacyAttachmentPolicy
+}}}
+This lists the [#ReadonlyWikiPolicy] which controls readonly access to wiki pages, followed by the !DefaultPermissionPolicy which checks for the traditional coarse grained style permissions described in TracPermissions, and the !LegacyAttachmentPolicy which knows how to use the coarse grained permissions for checking the permissions available on attachments.
 
 Among the possible optional choices, there is [#AuthzPolicy], a very generic permission policy, based on an Authz-style system. See
@@ -39 +39 @@
 [trac]
 ...
-permission_policies = AuthzPolicy, DefaultPermissionPolicy, LegacyAttachmentPolicy
+permission_policies = AuthzPolicy, ReadonlyWikiPolicy, DefaultPermissionPolicy, LegacyAttachmentPolicy
 }}}
   1. add a new `[authz_policy]` section
@@ -272 +272 @@
 {{{ 
 [trac]
-permission_policies = AuthzSourcePolicy, DefaultPermissionPolicy, LegacyAttachmentPolicy
+permission_policies = AuthzSourcePolicy, ReadonlyWikiPolicy, DefaultPermissionPolicy, LegacyAttachmentPolicy
 }}}
 
@@ -300 +300 @@
 }}}
 
-When upgrading from earlier versions of Trac, `ReadonlyWikiPolicy` needs to be manually added to the list.
-
-The `ReadonlyWikiPolicy` returns `False` to deny modify, delete and rename actions on wiki pages when the page has the read-only attribute set and the user does not have `WIKI_ADMIN`, regardless of whether the user has `WIKI_MODIFY`, `WIKI_DELETE` and `WIKI_RENAME` permissions. It returns `None` for all other cases. When active, the `AuthzPolicy` should therefore come before `ReadonlyWikiPolicy`, allowing it to grant or deny the actions on individual resources, which is the usual ordering for `AuthzPolicy` in the `permission_policies` list. `ReadonlyWikiPolicy` must come before `DefaultPermissionPolicy` since the latter will return `True` for the respective actions when the user has `WIKI_MODIFY`, `WIKI_DELETE` or `WIKI_RENAME`, without consideration for the read-only attribute. The placement of `AuthzSourcePolicy` relative to `ReadonlyWikiPolicy` does not matter since they don't perform checks on the same realms.
-
+When upgrading from earlier versions of Trac, `ReadonlyWikiPolicy` **needs to be manually added** to the list.
+
+**!ReadonlyWikiPolicy must be listed //before// !DefaultPermissionPolicy**. The latter returns `True` to allow modify, delete or rename actions when the user has the respective `WIKI_*` permission, without consideration for the read-only attribute.
+
+The `ReadonlyWikiPolicy` returns `False` to deny modify, delete and rename actions on wiki pages when the page has the read-only attribute set and the user does not have `WIKI_ADMIN`, regardless of `WIKI_MODIFY`, `WIKI_DELETE` and `WIKI_RENAME` permissions. It returns `None` for all other cases.
+
+When active, the [#AuthzPolicy] should therefore come before `ReadonlyWikiPolicy`, allowing it to grant or deny the actions on individual resources, which is the usual ordering for `AuthzPolicy` in the `permission_policies` list.
 {{{
 [trac]
@@ -312 +315 @@
 }}}
 
+The placement of [#AuthzSourcePolicy] relative to `ReadonlyWikiPolicy` does not matter since they don't perform checks on the same realms.
+
 For all other permission policies, the user will need to decide the proper ordering. Generally, if the permission policy should be capable of overriding the check performed by `ReadonlyWikiPolicy`, it should come before `ReadonlyWikiPolicy` in the list. If the `ReadonlyWikiPolicy` should override the check performed by another permission policy, as is the case for `DefaultPermissionPolicy`, then `ReadonlyWikiPolicy` should come first.