Changes between Version 2 and Version 3 of TracPermissions
- Timestamp:
- 03/13/22 22:11:41 (3 years ago)
Legend:
- Unmodified
- Added
- Removed
- Modified
-
TracPermissions
v2 v3 13 13 == Graphical Admin Tab 14 14 15 To access this tab, a user must have one of the following permissions: `TRAC_ADMIN`, `PERMISSION_ADMIN`, `PERMISSION_GRANT`, `PERMISSION_REVOKE`. The permissions can be granted using the `trac-admin` command (more on `trac-admin` below):15 To access this tab, a user must have one of the following permissions: `TRAC_ADMIN`, `PERMISSION_ADMIN`, `PERMISSION_GRANT`, `PERMISSION_REVOKE`. The permissions can be granted using the `trac-admin` command with a more detailed description [#GrantingPrivileges below]: 16 16 {{{#!sh 17 17 $ trac-admin /path/to/projenv permission add bob TRAC_ADMIN … … 30 30 == Available Privileges 31 31 32 To enable all privileges for a user, use the `TRAC_ADMIN` permission. Having `TRAC_ADMIN`is like being `root` on a *NIX system: it will allow you to perform any operation.33 34 Otherwise, individual privileges can be assigned to users for the various different functional areas of Trac ('''note that the privilege names are case-sensitive'''):32 To enable all privileges for a user, use the `TRAC_ADMIN` permission. This permission is like being `root` on a *NIX system: it will allow you to perform any operation. 33 34 Otherwise, individual privileges can be assigned to users for the different functional areas of Trac and '''note that the privilege names are uppercase''': 35 35 36 36 === Repository Browser … … 45 45 || `TICKET_VIEW` || View existing [TracTickets tickets] and perform [TracQuery ticket queries] || 46 46 || `TICKET_CREATE` || Create new [TracTickets tickets] || 47 || `TICKET_APPEND` || Add comments or attachments to [TracTickets tickets]||48 || `TICKET_CHGPROP` || Modify [TracTickets ticket] properties (priority, assignment, keywords, etc.) with the following exceptions: edit description field, add/remove other users from cc field when logged in ||47 || `TICKET_APPEND` || Add comments and attachments to [TracTickets tickets], and edit description of ticket the user created || 48 || `TICKET_CHGPROP` || Modify [TracTickets ticket] properties (priority, assignment, keywords, etc.) with the following exceptions: edit description of tickets created by others, add/remove other users from cc field when logged in || 49 49 || `TICKET_MODIFY` || Includes both `TICKET_APPEND` and `TICKET_CHGPROP`, and in addition allows resolving [TracTickets tickets] in the [TracWorkflow default workflow]. Tickets can be assigned to users through a [TracTickets#Assign-toasDrop-DownList drop-down list] when the list of possible owners has been restricted. || 50 50 || `TICKET_EDIT_CC` || Full modify cc field || 51 || `TICKET_EDIT_DESCRIPTION` || Modify description field ||51 || `TICKET_EDIT_DESCRIPTION` || Modify description field. User with `TICKET_APPEND` or `TICKET_CHGPROP` can modify description of ticket they created. || 52 52 || `TICKET_EDIT_COMMENT` || Modify another user's comments. Any user can modify their own comments by default. || 53 53 || `TICKET_BATCH_MODIFY` || [TracBatchModify Batch modify] tickets || 54 || `TICKET_ADMIN` || All `TICKET_*` permissions, deletion of ticket attachments and modification of the reporter field, which grants ability to create a ticket on behalf of another user (it will appear that another user created the ticket). It also allows managing ticket properties through the web administration module. ||54 || `TICKET_ADMIN` || All `TICKET_*` permissions, deletion of ticket attachments and modification of the reporter field, which grants ability to create a ticket on behalf of another user and it will appear that another user created the ticket. It also allows managing ticket properties through the web administration module. || 55 55 56 56 === Roadmap … … 95 95 || `EMAIL_VIEW` || Shows email addresses even if [TracIni#trac-section trac show_email_addresses] configuration option is false || 96 96 97 == Attachment Permissions 98 99 Attachment permissions are handled by `LegacyAttachmentPolicy`, and unlike the permissions discussed so far, the permissions provided by `LegacyAttachmentPolicy` are not directly granted. Rather, the ability to create, view and delete attachments is determined by the attachment's parent realm and permissions the user possesses for that realm. 100 101 The attachment actions are determined by the following 102 permissions in the ticket, wiki and milestone realms: 103 {{{#!table class="listing" 104 ||= Granted By: =||= Ticket =||= Wiki =||= Milestone =|| 105 || `ATTACHMENT_CREATE` || `TICKET_APPEND` || `WIKI_MODIFY` || `MILESTONE_MODIFY` || 106 || `ATTACHMENT_VIEW` || `TICKET_VIEW` || `WIKI_VIEW` || `MILESTONE_VIEW` || 107 || `ATTACHMENT_DELETE` || `TICKET_ADMIN` || `WIKI_DELETE` || `MILESTONE_DELETE` || 108 }}} 109 110 An authenticated user can delete an attachment //they added// without possessing the permission 111 that grants `ATTACHMENT_DELETE`. 112 113 If explicit attachment permissions are preferred, `ATTACHMENT_CREATE`, `ATTACHMENT_DELETE` and `ATTACHMENT_VIEW` can be created using the [trac:ExtraPermissionsProvider]. The simplest implementation is to simply define the actions. 114 {{{#!ini 115 [extra-permissions] 116 _perms = ATTACHMENT_CREATE, ATTACHMENT_DELETE, ATTACHMENT_VIEW 117 }}} 118 119 An alternative configuration adds an `ATTACHMENT_ADMIN` meta-permission that grants the other 3 permission. 120 {{{#!ini 121 [extra-permissions] 122 ATTACHMENT_ADMIN = ATTACHMENT_CREATE, ATTACHMENT_DELETE, ATTACHMENT_VIEW 123 }}} 124 125 The explicit permissions can be used in concert with `LegacyAttachmentPolicy`, or `LegacyAttachmentPolicy` can be removed from `permission_policies`, in which case only users that have been explicitly granted the corresponding attachment actions will be able to create, delete and view attachments. 126 97 127 == Granting Privileges 98 128 … … 123 153 Any user who has logged in is also in the //authenticated// group. 124 154 The //authenticated// group inherits permissions from the //anonymous// group. 125 For example, if the //anonymous// group has permission WIKI_MODIFY, 126 it is not necessary to add the WIKI_MODIFY permission to the //authenticated// group as well. 155 For example, if the //anonymous// group has permission WIKI_MODIFY, it is not necessary to add the WIKI_MODIFY permission to the //authenticated// group as well. 127 156 128 157 Custom groups may be defined that inherit permissions from the two built-in groups. … … 142 171 Permission groups can be created by assigning a user to a group you wish to create, then assign permissions to that group. 143 172 144 The following will add ''bob'' to the new group called ''beta_testers'' and then will assign WIKI_ADMIN permissions to that group. (Thus, ''bob'' will inherit the WIKI_ADMIN permission)173 The following will add ''bob'' to the new group called ''beta_testers'' and then will assign `WIKI_ADMIN` permissions to that group. Thus, ''bob'' will inherit the `WIKI_ADMIN` permission. 145 174 {{{#!sh 146 175 $ trac-admin /path/to/projenv permission add bob beta_testers … … 150 179 == Removing Permissions 151 180 152 Permissions can be removed using the 'remove' command. For example:181 Permissions can be removed using the 'remove' command. 153 182 154 183 This command will prevent the user ''bob'' from deleting reports: … … 180 209 //**anonymous**// 181 210 {{{ 182 BROWSER_VIEW 183 CHANGESET_VIEW 184 FILE_VIEW 185 LOG_VIEW 186 MILESTONE_VIEW 187 REPORT_SQL_VIEW 188 REPORT_VIEW 189 ROADMAP_VIEW 190 SEARCH_VIEW 191 TICKET_VIEW 211 BROWSER_VIEW 212 CHANGESET_VIEW 213 FILE_VIEW 214 LOG_VIEW 215 MILESTONE_VIEW 216 REPORT_SQL_VIEW 217 REPORT_VIEW 218 ROADMAP_VIEW 219 SEARCH_VIEW 220 TICKET_VIEW 192 221 TIMELINE_VIEW 193 222 WIKI_VIEW … … 196 225 //**authenticated**// 197 226 {{{ 198 TICKET_CREATE 199 TICKET_MODIFY 200 WIKI_CREATE 201 WIKI_MODIFY 227 TICKET_CREATE 228 TICKET_MODIFY 229 WIKI_CREATE 230 WIKI_MODIFY 202 231 }}} 203 232 ----
