Changes between Version 8 and Version 9 of TracPermissions


Ignore:
Timestamp:
Sep 10, 2020, 8:03:01 PM (2 weeks ago)
Author:
trac
Comment:

--

Legend:

Unmodified
Added
Removed
Modified
  • TracPermissions

    v8 v9  
    66Permissions are managed using the [TracAdmin trac-admin] tool or the ''General / Permissions'' panel in the ''Admin'' tab of the web interface.
    77
    8 In addition to the default permission policy described in this page, it is possible to activate additional permission policies by enabling [TracPlugins plugins] and listing them in [TracIni#trac-permission_policies-option "[trac] permission_policies"]. See TracFineGrainedPermissions for more details.
     8In addition to the default permission policy described in this page, it is possible to activate additional permission policies by enabling plugins and listing them in [TracIni#trac-permission_policies-option "[trac] permission_policies"]. See TracFineGrainedPermissions for more details.
    99
    1010Non-authenticated users accessing the system are assigned the name //anonymous//. Assign permissions to the //anonymous// user to set privileges for anonymous/guest users. The parts of Trac that a user does not have privilege for will not be displayed in the navigation.
     
    4545|| `TICKET_VIEW` || View existing [TracTickets tickets] and perform [TracQuery ticket queries] ||
    4646|| `TICKET_CREATE` || Create new [TracTickets tickets] ||
    47 || `TICKET_APPEND` || Add comments or attachments to [TracTickets tickets] ||
    48 || `TICKET_CHGPROP` || Modify [TracTickets ticket] properties (priority, assignment, keywords, etc.) with the following exceptions: edit description field, add/remove other users from cc field when logged in ||
     47|| `TICKET_APPEND` || Add comments and attachments to [TracTickets tickets], and edit description of ticket the user created ||
     48|| `TICKET_CHGPROP` || Modify [TracTickets ticket] properties (priority, assignment, keywords, etc.) with the following exceptions: edit description of tickets created by others, add/remove other users from cc field when logged in ||
    4949|| `TICKET_MODIFY` || Includes both `TICKET_APPEND` and `TICKET_CHGPROP`, and in addition allows resolving [TracTickets tickets] in the [TracWorkflow default workflow]. Tickets can be assigned to users through a [TracTickets#Assign-toasDrop-DownList drop-down list] when the list of possible owners has been restricted. ||
    5050|| `TICKET_EDIT_CC` || Full modify cc field ||
    51 || `TICKET_EDIT_DESCRIPTION` || Modify description field ||
     51|| `TICKET_EDIT_DESCRIPTION` || Modify description field. User with `TICKET_APPEND` or `TICKET_CHGPROP` can modify description of ticket they created. ||
    5252|| `TICKET_EDIT_COMMENT` || Modify another user's comments. Any user can modify their own comments by default. ||
    5353|| `TICKET_BATCH_MODIFY` || [TracBatchModify Batch modify] tickets ||
     
    9595|| `EMAIL_VIEW` || Shows email addresses even if [TracIni#trac-section trac show_email_addresses] configuration option is false ||
    9696
     97== Attachment Permissions
     98
     99Attachment permissions are handled by `LegacyAttachmentPolicy`, and unlike the permissions discussed so far, the permissions provided by `LegacyAttachmentPolicy` are not directly granted. Rather, the ability to create, view and delete attachments is determined by the attachment's parent realm and permissions the user possesses for that realm.
     100
     101The attachment actions are determined by the following
     102permissions in the ticket, wiki and milestone realms:
     103{{{#!table class="listing"
     104||= Granted By: =||= Ticket =||= Wiki =||= Milestone =||
     105|| `ATTACHMENT_CREATE` || `TICKET_APPEND` || `WIKI_MODIFY` || `MILESTONE_MODIFY` ||
     106|| `ATTACHMENT_VIEW` || `TICKET_VIEW` || `WIKI_VIEW` || `MILESTONE_VIEW` ||
     107|| `ATTACHMENT_DELETE` || `TICKET_ADMIN` || `WIKI_DELETE` || `MILESTONE_DELETE` ||
     108}}}
     109
     110An authenticated user can delete an attachment //they added// without possessing the permission
     111that grants `ATTACHMENT_DELETE`.
     112
     113If explicit attachment permissions are preferred, `ATTACHMENT_CREATE`, `ATTACHMENT_DELETE` and `ATTACHMENT_VIEW` can be created using the [trac:ExtraPermissionsProvider]. The simplest implementation is to simply define the actions.
     114{{{#!ini
     115[extra-permissions]
     116_perms = ATTACHMENT_CREATE, ATTACHMENT_DELETE, ATTACHMENT_VIEW
     117}}}
     118
     119An alternative configuration adds an `ATTACHMENT_ADMIN` meta-permission that grants the other 3 permission.
     120{{{#!ini
     121[extra-permissions]
     122ATTACHMENT_ADMIN = ATTACHMENT_CREATE, ATTACHMENT_DELETE, ATTACHMENT_VIEW
     123}}}
     124
     125The explicit permissions can be used in concert with `LegacyAttachmentPolicy`, or `LegacyAttachmentPolicy` can be removed from `permission_policies`, in which case only users that have been explicitly granted the corresponding attachment actions will be able to create, delete and view attachments.
     126
    97127== Granting Privileges
    98128
     
    179209//**anonymous**//
    180210{{{
    181 BROWSER_VIEW 
    182 CHANGESET_VIEW 
    183 FILE_VIEW 
    184 LOG_VIEW 
    185 MILESTONE_VIEW 
    186 REPORT_SQL_VIEW 
    187 REPORT_VIEW 
    188 ROADMAP_VIEW 
    189 SEARCH_VIEW 
    190 TICKET_VIEW 
     211BROWSER_VIEW
     212CHANGESET_VIEW
     213FILE_VIEW
     214LOG_VIEW
     215MILESTONE_VIEW
     216REPORT_SQL_VIEW
     217REPORT_VIEW
     218ROADMAP_VIEW
     219SEARCH_VIEW
     220TICKET_VIEW
    191221TIMELINE_VIEW
    192222WIKI_VIEW
     
    195225//**authenticated**//
    196226{{{
    197 TICKET_CREATE 
    198 TICKET_MODIFY 
    199 WIKI_CREATE 
    200 WIKI_MODIFY 
     227TICKET_CREATE
     228TICKET_MODIFY
     229WIKI_CREATE
     230WIKI_MODIFY
    201231}}}
    202232----