[Zope3-checkins] CVS: zopeproducts/bugtracker - INSTALL.txt:1.2 TODO.txt:1.2 configure.zcml:1.2 vocabulary.py:1.2
Stephan Richter
srichter@cosmos.phy.tufts.edu
Thu, 24 Jul 2003 17:39:43 -0400
Update of /cvs-repository/zopeproducts/bugtracker
In directory cvs.zope.org:/tmp/cvs-serv2895
Modified Files:
INSTALL.txt TODO.txt configure.zcml vocabulary.py
Log Message:
Implemented security features. It seems all to work well based on my tests.
=== zopeproducts/bugtracker/INSTALL.txt 1.1 => 1.2 ===
--- zopeproducts/bugtracker/INSTALL.txt:1.1 Thu Jul 24 14:08:03 2003
+++ zopeproducts/bugtracker/INSTALL.txt Thu Jul 24 17:39:07 2003
@@ -11,14 +11,14 @@
<include package='zopeproducts.bugtracker' />
- - XXX: (Not yet) You need to define the following role declarations to your
- user in order to use the zwiki product effectively.
+ - You need to define the following role declarations to your user in order
+ to use the bug tracker product effectively.
- <grant role="BugTrackerAdmin" principal="user" />
- <grant role="BugTrackerEditor" principal="user" />
- <grant role="BugTrackerUser" principal="user" />
+ <grant role="bugtracker.Admin" principal="user" />
+ <grant role="bugtracker.Editor" principal="user" />
+ <grant role="bugtracker.User" principal="user" />
- <grant role="BugTrackerUser" principal="anybody" />
+ <grant role="bugtracker.User" principal="anybody" />
Usage
=== zopeproducts/bugtracker/TODO.txt 1.1 => 1.2 ===
--- zopeproducts/bugtracker/TODO.txt:1.1 Thu Jul 24 14:08:03 2003
+++ zopeproducts/bugtracker/TODO.txt Thu Jul 24 17:39:07 2003
@@ -17,13 +17,6 @@
- Provide a sample translation (probably German).
- Security
-
- - Declare permissions and roles
-
- - Assign correct permissions to objects and views
-
-
UI
- Display Term title instead of value in the drop-down elements.
=== zopeproducts/bugtracker/configure.zcml 1.1 => 1.2 ===
--- zopeproducts/bugtracker/configure.zcml:1.1 Thu Jul 24 14:08:03 2003
+++ zopeproducts/bugtracker/configure.zcml Thu Jul 24 17:39:07 2003
@@ -4,32 +4,115 @@
xmlns:mail="http://namespaces.zope.org/mail"
xmlns:translate="http://namespaces.zope.org/gts">
- <!-- Setting up the vocabularies for the bug tracker -->
-
- <vocabulary
- name="Stati"
- factory=".vocabulary.StatusVocabulary" />
-
- <vocabulary
- name="Releases"
- factory=".vocabulary.ReleaseVocabulary" />
-
- <vocabulary
- name="Priorities"
- factory=".vocabulary.PriorityVocabulary" />
-
- <vocabulary
- name="BugTypes"
- factory=".vocabulary.BugTypeVocabulary" />
-
- <vocabulary
- name="Users"
- factory=".vocabulary.UserVocabulary" />
+ <!-- Security setup -->
+ <role
+ id="bugtracker.User"
+ title="Bug Tracker User"
+ description="The user can browse the bug tracker" />
+
+ <role
+ id="bugtracker.Editor"
+ title="Bug Tracker Editor"
+ description="The Bug Tracker editor can add and edit bugs." />
+
+ <role
+ id="bugtracker.Admin"
+ title="Bug Tracker Administrator"
+ description="The Wiki Admin can fully manage a bug tracker." />
+
+ <permission
+ id="bugtracker.ManageBugTracker"
+ title="Manage Bug Tracker"
+ description="Allows to change the settings of the Bug Tracker." />
+
+ <grant
+ permission="bugtracker.ManageBugTracker"
+ role="bugtracker.Admin" />
+
+ <permission
+ id="bugtracker.ViewBugTracker"
+ title="View Bug Tracker"
+ description="Allows to view the overview of the Bug Tracker." />
+
+ <grant
+ permission="bugtracker.ViewBugTracker"
+ role="bugtracker.User" />
+
+ <permission
+ id="bugtracker.ViewBug"
+ title="View Bug"
+ description="Allows to view the overview and dependencies of the Bug." />
+
+ <grant
+ permission="bugtracker.ViewBug"
+ role="bugtracker.User" />
+
+ <permission
+ id="bugtracker.AddBug"
+ title="Add Bug"
+ description="Allows to add a Bug to the Tracker." />
+
+ <grant
+ permission="bugtracker.AddBug"
+ role="bugtracker.User" />
+
+ <permission
+ id="bugtracker.EditBug"
+ title="Edit Bug"
+ description="Allows to edit the data of a Bug." />
+
+ <grant
+ permission="bugtracker.EditBug"
+ role="bugtracker.Editor" />
+
+ <permission
+ id="bugtracker.AddComment"
+ title="Add Bug Comment"
+ description="Allows to add comments to a bug." />
+
+ <grant
+ permission="bugtracker.AddComment"
+ role="bugtracker.User" />
+
+ <permission
+ id="bugtracker.AddAttachment"
+ title="Add Bug Attachment"
+ description="Allows to add attachments (files and images) to a bug." />
+
+ <grant
+ permission="bugtracker.AddAttachment"
+ role="bugtracker.Editor" />
+
+ <!-- Setting up the vocabularies for the bug tracker -->
+
+ <vocabulary
+ name="Stati"
+ factory=".vocabulary.StatusVocabulary" />
+
+ <vocabulary
+ name="Releases"
+ factory=".vocabulary.ReleaseVocabulary" />
+
+ <vocabulary
+ name="Priorities"
+ factory=".vocabulary.PriorityVocabulary" />
+
+ <vocabulary
+ name="BugTypes"
+ factory=".vocabulary.BugTypeVocabulary" />
+
+ <vocabulary
+ name="Users"
+ factory=".vocabulary.UserVocabulary" />
<content class=".vocabulary.ManagableVocabulary">
- <allow interface=".interfaces.IManagableVocabulary"/>
+ <allow interface="zope.schema.interfaces.IVocabulary"/>
+ <allow interface="zope.schema.interfaces.IVocabularyTokenized"/>
<allow attributes="__contains__"/>
+ <require
+ permission="bugtracker.ManageBugTracker"
+ attributes="add delete"/>
</content>
<content class=".vocabulary.StatusVocabulary">
@@ -62,7 +145,9 @@
<content class=".vocabulary.UserTerm">
<allow
interface="zope.schema.interfaces.ITokenizedTerm"/>
- <allow attributes="principal"/>
+ <require
+ permission="bugtracker.ViewBug"
+ attributes="principal title"/>
</content>
<!-- Bug Tracker related configuration -->
@@ -74,7 +159,7 @@
<factory
id="BugTracker"
- permission="zope.View"
+ permission="zope.ManageContent"
title="Bug Tracker"
description="A Bug Tracker" />
@@ -85,15 +170,15 @@
interface="zope.app.interfaces.services.service.Write" />
<require
- permission="zope.View"
+ permission="bugtracker.ViewBugTracker"
interface="zope.app.interfaces.container.IReadContainer"/>
<require
- permission="zope.View"
+ permission="bugtracker.AddBug"
interface="zope.app.interfaces.container.IWriteContainer"/>
<require
- permission="zope.View"
+ permission="zope.ManageContent"
set_schema=".interfaces.IBugTracker" />
</content>
@@ -135,21 +220,24 @@
<factory
id="Bug"
- permission="zope.View"
+ permission="bugtracker.AddBug"
title="Bug"
description="A Bug" />
<require
- permission="zope.View"
+ permission="bugtracker.ViewBug"
interface="zope.app.interfaces.container.IReadContainer"/>
<require
- permission="zope.View"
+ permission="bugtracker.EditBug"
interface="zope.app.interfaces.container.IWriteContainer"/>
<require
- permission="zope.View"
- interface=".interfaces.IBug"
+ permission="bugtracker.ViewBug"
+ interface=".interfaces.IBug" />
+
+ <require
+ permission="bugtracker.AddBug"
set_schema=".interfaces.IBug" />
</content>
@@ -179,13 +267,16 @@
<factory
id="BugComment"
- permission="zope.View"
+ permission="bugtracker.AddComment"
title="Comment"
description="A comment about the bug." />
<require
- permission="zope.View"
- interface=".interfaces.IComment"
+ permission="bugtracker.ViewBug"
+ interface=".interfaces.IComment" />
+
+ <require
+ permission="bugtracker.AddComment"
set_schema=".interfaces.IComment" />
</content>
=== zopeproducts/bugtracker/vocabulary.py 1.1 => 1.2 ===
--- zopeproducts/bugtracker/vocabulary.py:1.1 Thu Jul 24 14:08:03 2003
+++ zopeproducts/bugtracker/vocabulary.py Thu Jul 24 17:39:07 2003
@@ -27,6 +27,7 @@
from zope.app.interfaces.security import IAuthenticationService
from zope.app.services.servicenames import Authentication
+from zope.security.proxy import trustedRemoveSecurityProxy
from zopeproducts.bugtracker.interfaces import IManagableVocabulary, IBugTracker
from zopeproducts.bugtracker.interfaces import \
IStatusVocabulary, IReleaseVocabulary, IPriorityVocabulary
@@ -138,9 +139,15 @@
implements(ITokenizedTerm)
def __init__(self, principal):
- self.principal = principal
- self.value = principal.getId()
- self.token = principal.getId()
+ # This is safe here, since we only read non-critical data
+ naked = trustedRemoveSecurityProxy(principal)
+ self.principal = {'id': naked.getId(),
+ 'login': naked.getLogin(),
+ 'title': naked.getTitle(),
+ 'description': naked.getDescription()}
+ self.value = naked.getId()
+ self.token = naked.getId()
+ self.title = naked.getTitle()
class UserVocabulary(object):
@@ -169,3 +176,12 @@
def getTermByToken(self, token):
return self.getTerm(token)
+
+
+# Monkey Patching going on...
+from zope.app.browser.form.vocabularywidget import ViewSupport
+
+def textForValue(self, term):
+ return getattr(term, 'title', term.token)
+
+ViewSupport.textForValue = textForValue