2727revision = String ())
2828
2929
30-
3130# Component
3231component = Class (db , 'component' ,
3332 name = String (),
7675 name = String (),
7776 description = String ())
7877keyword .setkey ("name" )
79-
78+
8079
8180# User-defined saved searches
8281query = Class (db , "query" ,
209208 db .security .addPermissionToRole (r , 'Email Access' )
210209 db .security .addPermissionToRole (r , 'Rest Access' )
211210 db .security .addPermissionToRole (r , 'Xmlrpc Access' )
212-
211+
213212##########################
214213# User permissions
215214##########################
225224 'version' , 'priority' , 'status' , 'resolution' ,
226225 'bug_type' , 'bug' , 'file' , 'msg' ):
227226 db .security .addPermissionToRole ('User' , 'Create' , cl )
228-
227+
229228
230229def may_edit_file (db , userid , itemid ):
231230 return userid == db .file .get (itemid , "creator" )
232231
232+
233233p = db .security .addPermission (name = 'Edit' , klass = 'file' , check = may_edit_file ,
234234 description = "User is allowed to remove their own files" )
235235db .security .addPermissionToRole ('User' , p )
@@ -297,7 +297,7 @@ def may_edit_file(db, userid, itemid):
297297
298298# May users view other user information? Comment these lines out
299299# if you don't want them to
300- p = db .security .addPermission (name = 'View' , klass = 'user' ,
300+ p = db .security .addPermission (name = 'View' , klass = 'user' ,
301301 properties = ('id' , 'organisation' , 'phone' , 'realname' , 'timezone' ,
302302 'vcs_name' , 'username' ))
303303db .security .addPermissionToRole ('User' , p )
@@ -310,11 +310,14 @@ def may_edit_file(db, userid, itemid):
310310db .security .addPermissionToRole ('Coordinator' , 'Edit' , 'user' )
311311db .security .addPermissionToRole ('Coordinator' , 'Web Roles' )
312312
313+
313314# Users should be able to edit their own details -- this permission is
314315# limited to only the situation where the Viewed or Edited item is their own.
315316def own_record (db , userid , itemid ):
316317 '''Determine whether the userid matches the item being accessed.'''
317318 return userid == itemid
319+
320+
318321p = db .security .addPermission (name = 'View' , klass = 'user' , check = own_record ,
319322 description = "User is allowed to view their own user details" )
320323for r in 'User' , 'Developer' , 'Coordinator' :
@@ -326,19 +329,24 @@ def own_record(db, userid, itemid):
326329 'phone' , 'organisation' ,
327330 'alternate_addresses' ,
328331 'queries' ,
329- 'timezone' )) # Note: 'roles' excluded - users should not be able to edit their own roles.
332+ 'timezone' )) # Note: 'roles' excluded - users should not be able to edit their own roles.
330333for r in 'User' , 'Developer' :
331334 db .security .addPermissionToRole (r , p )
332335
336+
333337# Users should be able to edit and view their own queries. They should also
334338# be able to view any marked as not private. They should not be able to
335339# edit others' queries, even if they're not private
336340def view_query (db , userid , itemid ):
337341 private_for = db .query .get (itemid , 'private_for' )
338342 if not private_for : return True
339343 return userid == private_for
344+
345+
340346def edit_query (db , userid , itemid ):
341347 return userid == db .query .get (itemid , 'creator' )
348+
349+
342350p = db .security .addPermission (name = 'View' , klass = 'query' , check = view_query ,
343351 description = "User is allowed to view their own and public queries" )
344352p = db .security .addPermission (name = 'Search' , klass = 'query' )
@@ -387,7 +395,7 @@ def edit_query(db, userid, itemid):
387395# anonymous, you should remove this entry as it can be used to perform
388396# a username guessing attack against a roundup install.
389397p = db .security .addPermission (name = 'Search' , klass = 'user' )
390- db .security .addPermissionToRole ('Anonymous' , p )
398+ db .security .addPermissionToRole ('Anonymous' , p )
391399
392400# [OPTIONAL]
393401# Allow anonymous users access to create or edit "issue" items (and the
0 commit comments