Edgewall Software

Changes between Version 69 and Version 70 of TracFineGrainedPermissions


Ignore:
Timestamp:
Mar 6, 2022, 8:51:43 AM (4 months ago)
Author:
figaro
Comment:

Cosmetic changes

Legend:

Unmodified
Added
Removed
Modified
  • TracFineGrainedPermissions

    v69 v70  
    2828* !LegacyAttachmentPolicy uses the coarse-grained permissions to check permissions on attachments.
    2929
    30 Among the optional choices, there is [#AuthzPolicy], a very generic permission policy, based on an Authz-style system. See
    31 [trac:source:branches/1.4-stable/tracopt/perm/authz_policy.py authz_policy.py] for details.
     30Among the optional choices, there is [#AuthzPolicy], a very generic permission policy, based on an Authz-style system. See [trac:source:branches/1.4-stable/tracopt/perm/authz_policy.py authz_policy.py] for details.
    3231
    3332Another permission policy [#AuthzSourcePolicy], uses the [http://svnbook.red-bean.com/nightly/en/svn.serverconfig.pathbasedauthz.html path-based authorization] defined by Subversion to enforce permissions on the version control system.
     
    3736=== !AuthzPolicy
    3837==== Configuration
    39 * Put an empty conf file (`authzpolicy.conf`) in a secure location on the server, not readable by users other than the webuser. If the  file contains non-ASCII characters, the UTF-8 encoding should be used.
     38
     39* Put an empty conf file (`authzpolicy.conf`) in a secure location on the server, not readable by users other than the webuser. If the file contains non-ASCII characters, the UTF-8 encoding should be used.
    4040* Update your `trac.ini`:
    4141  1. modify the [TracIni#trac-permission_policies-option permission_policies] option in the `[trac]` section:
     
    6161A policy will return either `True`, `False` or `None` for a given permission check. `True` is returned if the policy explicitly grants the permission. `False` is returned if the policy explicitly denies the permission. `None` is returned if the policy is unable to either grant or deny the permission.
    6262
    63 NOTE: Only if the return value is `None` will the ''next'' permission policy be consulted. If none of the policies explicitly grants the permission, the final result will be `False`, i.e. permission denied.
     63'''Note''': Only if the return value is `None` will the ''next'' permission policy be consulted. If none of the policies explicitly grants the permission, the final result will be `False`, i.e. permission denied.
    6464
    6565The `authzpolicy.conf` file is a `.ini` style configuration file:
     
    100100The username will match any of 'anonymous', 'authenticated', <username> or '*', using normal Trac permission rules.
    101101
    102 || '''Note:''' Other groups which are created by user (e.g. by 'adding subjects to groups' on web interface page //Admin / Permissions//) cannot be used. See [trac:#5648] for details about this missing feature. ||
     102'''Note''': Other groups which are created by user (e.g. by 'adding subjects to groups' on web interface page //Admin / Permissions//) cannot be used. See [trac:#5648] for details about this missing feature.
    103103
    104104For example, if the `authz_file` contains:
     
    184184
    185185==== Missing Features
     186
    186187Although possible with the !DefaultPermissionPolicy handling (see Admin panel), fine-grained permissions still miss those grouping features (see [trac:#9573], [trac:#5648]). Patches are partially available, see authz_policy.2.patch, part of [trac:ticket:6680 #6680].
    187188
     
    199200[groups]
    200201permission_level_1 = WIKI_VIEW, TICKET_VIEW
    201 permission_level_2  = permission_level_1, WIKI_MODIFY, TICKET_MODIFY
     202permission_level_2 = permission_level_1, WIKI_MODIFY, TICKET_MODIFY
    202203[*]
    203204@team1 = permission_level_1
     
    206207}}}
    207208
    208 === !AuthzSourcePolicy  (`mod_authz_svn`-like permission policy) #AuthzSourcePolicy
     209=== !AuthzSourcePolicy (`mod_authz_svn`-like permission policy) #AuthzSourcePolicy
    209210
    210211`AuthzSourcePolicy` can be used for restricting access to the repository. Granular permission control needs a definition file, which is the one used by Subversion's `mod_authz_svn`.
     
    319320
    320321== Debugging permissions
     322
    321323In trac.ini set:
    322324{{{#!ini