Changes between Version 77 and Version 78 of SimpleMultiProjectPlugin

Timestamp:

Aug 4, 2020, 7:42:24 PM (4 years ago)

Author:

Cinc-th

Comment:

Described the new permission handling.

SimpleMultiProjectPlugin

@@ -161 +161 @@
 == Project restrictions
 === Current trunk and releases 0.7.2+
-A new permission system is currently developed and the first implementation landed with [17810]. See ticket #13850 used for tracking the effort.
-
-To activate project restrictions add the following permission policy:
+A new permission system is implemented by a new permission policy ''SmpPermissionPolicy'' and additional request filtering. The latter is necessary because TracFineGrainedPermissions are limited to some resources, notably excluding versions and components.
+
+For permission checking and proper filtering the permission policy plugin must be activated and configured in trac.ini:
 {{{#!ini
 [trac]
@@ -170 +170 @@
 Make sure the new policy is the first in the list of available policies.
 
+You may mark a project as restricted on the project admin page which has the following effects.
+
+ * Tickets linked with a restricted project can't be accessed by users without permissions. 
+ 
+ This works for individual ticket pages, ticket queries, the timeline page and everywhere else a ticket is shown.
+ * Milestones belonging to restricted projects can't be accessed without permissions. 
+
+ This affects ticket queries, the roadmap and timeline pages and individual ticket pages.
+ * Components and versions of restricted projects are not available for queries or when creating/modifying ticket pages. 
+
+Projects without restrictions and their linked resources can be accessed by any user. Normal Trac permission settings apply. 
+
 Project permissions are assigned using the Trac permission admin panel. Each project has a unique ID which is not changing over the lifetime of  a project, even if you change the project name.[[BR]]
-To give a user access to a project you have to give the permission '''PROJECT_<id>_MEMBER''' where ''<id>'' is the unique project id.
-
-The following restrictions are currently in place:
- * Ticket filtering. Users only see tickets belonging to projects they're a member of. Tickets of projects without restrictions are always shown.
- 
- This works for ticket pages and when doing custom queriers. 
- * Component, version and milestone filtering on ticket pages.
- * Milestone filtering on roadmap and timeline pages.
+To give a user access to a project you have to give the permission '''PROJECT_<id>_MEMBER''' where ''<id>'' is the unique project id. For finer control over individual resources the normal Trac permissions are available. 
+
+This means the project permission is a coarse filter to only prevent global project resources access. You can't have individual fine grained resource access for different projects because normal Trac permissions are defined for all projects. Use TracFineGrainedPermissions if you need such control. 
 
 Note that filtering by project is always done.