Add support for specific permission to manage custom fields

[ahamelin]

I would find it useful to be able to use a distinct permission to manage custom ticket fields, like some other popular plugins do.

The issue I see right now is that managing custom fields require the full TICKET_ADMIN permission. This approach has a couple of downsides, such as permitting a user to change the owner of a ticket, etc. which is not necessarily bound to managing ticket fields, and gives more power to certain group of users than it is minimally necessary.

A minimal implementation could only include CUSTOM_FIELDS_ADMIN which would grant access to the Admin > Custom Fields admin panel. I would expect TICKET_ADMIN to still give access to the custom fields admin panel.

[Ryan J Ollos]

This is generally handled in Trac using ​TracFineGrainedPermissions. This is a very powerful feature that also help prevent the bloat of very specific permissions which may only apply to a narrow subset of users. Many TracFineGrainedPermissions policy issues in the admin realm have been fixed in Trac 1.0.2dev: ​trac:#11069.

I tested a permissions policy with Trac 1.0.1 and the latest CustomFieldAdminPlugin. The following patch is needed (which is very similar to the changes in ​trac:#11069):

customfieldadminplugin/0.11/customfieldadmin/admin.py

@@ -30 +30 @@
     # IAdminPanelProvider methods
     
     def get_admin_panels(self, req):
-        if 'TICKET_ADMIN' in req.perm:
+        if 'TICKET_ADMIN' in req.perm('admin', 'ticket/customfields'):
             yield ('ticket', _("Ticket System"),
                    'customfields', _("Custom Fields")) 
 
     def render_admin_panel(self, req, cat, page, customfield):
-        req.perm.require('TICKET_ADMIN')
+        req.perm('admin', 'ticket/customfields').require('TICKET_ADMIN')
         
         add_script(req, 'customfieldadmin/js/customfieldadmin.js')

osimons, would you kindly review?

After the patch is applied, the following policy would allow all users to access the Custom Fields page. This is probably not what you want, and is just meant as an example to get you started. See the ​TracFineGrainedPermissions for more details.

[admin:ticket/customfields]
* = TICKET_ADMIN

[Ryan J Ollos]

In 14259:

0.2.9: Support fine-grained permission checks on the Custom Field admin pages. Fixes #11826.