Changes between Version 4 and Version 5 of TracFineGrainedPermissions
- Timestamp:
- Sep 8, 2024, 12:14:12 PM (3 months ago)
Legend:
- Unmodified
- Added
- Removed
- Modified
-
TracFineGrainedPermissions
v4 v5 28 28 * !LegacyAttachmentPolicy uses the coarse-grained permissions to check permissions on attachments. 29 29 30 Among the optional choices, there is [#AuthzPolicy], a very generic permission policy, based on an Authz-style system. See [trac:source:branches/1.4-stable/tracopt/perm/authz_policy.py authz_policy.py] for details. 30 Among the optional choices, there is [#AuthzPolicy], a very generic permission policy, based on an Authz-style system. See 31 [trac:source:branches/1.4-stable/tracopt/perm/authz_policy.py authz_policy.py] for details. 31 32 32 33 Another permission policy [#AuthzSourcePolicy], uses the [http://svnbook.red-bean.com/nightly/en/svn.serverconfig.pathbasedauthz.html path-based authorization] defined by Subversion to enforce permissions on the version control system. … … 36 37 === !AuthzPolicy 37 38 ==== Configuration 38 39 * Put an empty conf file (`authzpolicy.conf`) in a secure location on the server, not readable by users other than the webuser. If the file contains non-ASCII characters, the UTF-8 encoding should be used. 39 * Put an empty conf file (`authzpolicy.conf`) in a secure location on the server, not readable by users other than the webuser. If the file contains non-ASCII characters, the UTF-8 encoding should be used. 40 40 * Update your `trac.ini`: 41 41 1. modify the [TracIni#trac-permission_policies-option permission_policies] option in the `[trac]` section: … … 61 61 A policy will return either `True`, `False` or `None` for a given permission check. `True` is returned if the policy explicitly grants the permission. `False` is returned if the policy explicitly denies the permission. `None` is returned if the policy is unable to either grant or deny the permission. 62 62 63 '''Note''': Only if the return value is `None` will the ''next'' permission policy be consulted. If none of the policies explicitly grants the permission, the final result will be `False`, i.e. permission denied.63 NOTE: Only if the return value is `None` will the ''next'' permission policy be consulted. If none of the policies explicitly grants the permission, the final result will be `False`, i.e. permission denied. 64 64 65 65 The `authzpolicy.conf` file is a `.ini` style configuration file: … … 100 100 The username will match any of 'anonymous', 'authenticated', <username> or '*', using normal Trac permission rules. 101 101 102 '''Note''': Other groups which are created by user (e.g. by 'adding subjects to groups' on web interface page //Admin / Permissions//) cannot be used. See [trac:#5648] for details about this missing feature. 102 || '''Note:''' Other groups which are created by user (e.g. by 'adding subjects to groups' on web interface page //Admin / Permissions//) cannot be used. See [trac:#5648] for details about this missing feature. || 103 103 104 104 For example, if the `authz_file` contains: … … 184 184 185 185 ==== Missing Features 186 187 186 Although possible with the !DefaultPermissionPolicy handling (see Admin panel), fine-grained permissions still miss those grouping features (see [trac:#9573], [trac:#5648]). Patches are partially available, see authz_policy.2.patch, part of [trac:ticket:6680 #6680]. 188 187 … … 200 199 [groups] 201 200 permission_level_1 = WIKI_VIEW, TICKET_VIEW 202 permission_level_2 = permission_level_1, WIKI_MODIFY, TICKET_MODIFY201 permission_level_2 = permission_level_1, WIKI_MODIFY, TICKET_MODIFY 203 202 [*] 204 203 @team1 = permission_level_1 … … 207 206 }}} 208 207 209 === !AuthzSourcePolicy (`mod_authz_svn`-like permission policy) #AuthzSourcePolicy208 === !AuthzSourcePolicy (`mod_authz_svn`-like permission policy) #AuthzSourcePolicy 210 209 211 210 `AuthzSourcePolicy` can be used for restricting access to the repository. Granular permission control needs a definition file, which is the one used by Subversion's `mod_authz_svn`. … … 320 319 321 320 == Debugging permissions 322 323 321 In trac.ini set: 324 322 {{{#!ini
