A minimalistic wiki, project management and issue/bug tracker system.

headers Daragh Fitzpatrick | 1 Jun 2004 17:14

_______________________________________________
Trac mailing list
Trac@...
http://lists.edgewall.com/mailman/listinfo/trac

Hi,

Is there any plan to implement group management in Trac ACL ?

The granularity of a single user is nice, but somewhat difficult to manage 
from an administrator perpective. It would be nice if Trac were able to handle 
group in addition to single user permissions.

As we use LDAP authentication on our web server, I've added group management 
to Trac ACLs. Group permissions are defined in the SQLite permission table, as 
it is for single user. I've used the usual character to denote groups among 
users:  <at> . 
A 'group' is therefore prefixed with a ' <at> ' sign, like ' <at> administrators'

In order not to change the current Trac implementation, I did not change the 
way user permissions are stored and retrieved. However, this may not scale 
well to large directories with many different groups.

trac-admin does support 'usernames' with  <at>  sign.

The current implementation does the following (in perm.py)

if user 'anonymous': perform the same code than original trac code
if user not 'anonymous':
   open a connection to the LDAP directory
   retrieve the list of all available groups in the LDAP directory (*)
   filter out all groups the user not belongs to (from LDAP group lists)
   for each group (and) user
      read and use permissions of the group as defined in SQLite permission 
table

This way, if user belongs to group  <at> agroup (in LDAP), user is assigned 
permission from group  <at> agroup (in SQLite).

(*): this may not fit well to directories using many different group in the 
same base DN. 

As ACL are tested for each cgi request, this may lead to poor performances. 
I do not know how to improve this. Please let me know if there is a better way 
to use group permissions.

Emmanuel.

--

-- 

Hi,
First of all congratulations on a great project! I had a Trac database 
up and running in a couple of days.  Admittedly I had already 
implemented a Subversion system, but other than that I am a web server 
newbie.

Now I am trying to set up a multi project system for the company.  What 
I envision is allowing suitably authorised users to create projects via 
a web page.  When a project is created a subversion repository will be 
set up and a trac database created and configured. The 
TracMultipleProjects page of the wiki goes part of the way and I have 
got that Apache config up and running.  The bit I am struggling with now 
is automatically setting up the Trac database.  There is no 
non-interactive way of doing an initenv.  Once the environment is 
initialised I can get the project ini file and edit that, but changing 
user access privileges and other trac-admin config is a bit harder 
(requiring direct access to the database I think. arrgh!).

Has anyone written any code that will set up priviledges based on 
command line arguments or a file?

Another idea which should be quite easy to implement is to add more 
power to the priviledges "add" and "remove" commands by allowing regexp 
matching.  Does SQLite support some sort of wild cards? If so you could 
just pass that straight through.

It would be useful to be able to change all of the configuration using 
command line arguments to trac-admin as this would enable easy scripting 
  for administration purposes.

If no one has done any of this I might just have to learn python and 
dust of my severley limited SQL knowledge.  Is the database schema 
documented anywhere?

Thanks for your time...

Felix

I would like to do groups, but don't know how to do it (admittedly my
project is small, so I was lazy about looking at the documentation on how to
do it, if possible) 

The way I set up permissions is to create a file, and copy and paste the
list of commands into the trac-admin session - so yes, it requires
interaction.

The approach I'd suggest is looking at the python code for trac-admin, and
coding something based around it.

That said, it seems to be possible to make trac-admin command-line calls in
UNIX - our current config is Windoze.

Cheers,

          :D

--------------------------------------------------------------------
Daragh Fitzpatrick        Daragh@...         (773) 702-8976

Solutions Architect                      NSIT Administrative Systems
Renewal Projects and Architecture              University of Chicago
--------------------------------------------------------------------
-----Original Message-----
From: trac-bounces@...
[mailto:trac-bounces@...] On Behalf Of Felix Collins
Sent: Wednesday, June 02, 2004 6:57 PM
To: trac@...
Subject: [Trac] Creating multiple Trac projects

Hi,
First of all congratulations on a great project! I had a Trac database up
and running in a couple of days.  Admittedly I had already implemented a
Subversion system, but other than that I am a web server newbie.

Now I am trying to set up a multi project system for the company.  What I
envision is allowing suitably authorised users to create projects via a web
page.  When a project is created a subversion repository will be set up and
a trac database created and configured. The TracMultipleProjects page of the
wiki goes part of the way and I have got that Apache config up and running.
The bit I am struggling with now is automatically setting up the Trac
database.  There is no non-interactive way of doing an initenv.  Once the
environment is initialised I can get the project ini file and edit that, but
changing user access privileges and other trac-admin config is a bit harder
(requiring direct access to the database I think. arrgh!).

Has anyone written any code that will set up priviledges based on command
line arguments or a file?

Another idea which should be quite easy to implement is to add more power to
the priviledges "add" and "remove" commands by allowing regexp matching.
Does SQLite support some sort of wild cards? If so you could just pass that
straight through.

It would be useful to be able to change all of the configuration using
command line arguments to trac-admin as this would enable easy scripting
  for administration purposes.

If no one has done any of this I might just have to learn python and dust of
my severley limited SQL knowledge.  Is the database schema documented
anywhere?

Thanks for your time...

Felix
_______________________________________________
Trac mailing list
Trac@...
http://lists.edgewall.com/mailman/listinfo/trac

Daragh Fitzpatrick wrote:

> The way I set up permissions is to create a file, and copy and paste the
> list of commands into the trac-admin session - so yes, it requires
> interaction.

What about doing an "initenv"?

> The approach I'd suggest is looking at the python code for trac-admin, and
> coding something based around it.

Already had a look at the source.  It doesn't look to hard so maybe I'll 
have a hack at it.

> That said, it seems to be possible to make trac-admin command-line calls in
> UNIX - our current config is Windoze.

Woops, yep you can make command line calls. I guess all I need is for 
initenv to take a command line arg.  Maybe a file like in .ini format 
that specifies all the stuff that it asks for.

Felix

Hi,

If you have Subversion set up using an Apache server with the 
authz_svn_module providing directory level access control and you set up 
Trac, the Trac browser neatly bypasses the access control.

This is quite a likely scenario as you will no doubt be running Trac on 
the same Apache server as you Subversion install.

It is only a problem if you don't want all your users to be able to read 
the whole repository, but in this case it renders the Trac repository 
browser unusable.  My example is a private company project with nothing 
is visible to unauthenticated users some with r/w and some only read 
privileges.  We also have a contractor who should only be allowed to 
read and write under certain directories on one project.

Is there anyway that Trac could check with the authz_svn_module to see 
if it is OK to browse a particular part of the repository?  Is there a 
library in Subversion for this?

Which level of access does Trac use to read from the subversion 
repository: repository layer, repository access layer or client layer?

Cheers,
Felix

Hi Felix,

Am 03.06.2004 um 05:29 schrieb Felix Collins:
> Hi,
>
> If you have Subversion set up using an Apache server with the 
> authz_svn_module providing directory level access control and you set 
> up Trac, the Trac browser neatly bypasses the access control.
>
> This is quite a likely scenario as you will no doubt be running Trac 
> on the same Apache server as you Subversion install.
>
> It is only a problem if you don't want all your users to be able to 
> read the whole repository, but in this case it renders the Trac 
> repository browser unusable.  My example is a private company project 
> with nothing is visible to unauthenticated users some with r/w and 
> some only read privileges.  We also have a contractor who should only 
> be allowed to read and write under certain directories on one project.
>
> Is there anyway that Trac could check with the authz_svn_module to see 
> if it is OK to browse a particular part of the repository?  Is there a 
> library in Subversion for this?

see http://projects.edgewall.com/trac/wiki/FineGrainedPermissions

> Which level of access does Trac use to read from the subversion 
> repository: repository layer, repository access layer or client layer?

The repository layer (RA isn't available because the Python bindings 
are not usable yet, IIUC).

Cheers,
Chris
--
Christopher Lenz
/=/ cmlenz at gmx.de

_______________________________________________
Trac mailing list
Trac@...
http://lists.edgewall.com/mailman/listinfo/trac

Thanks for that Christopher.  It is great to see someone was on to the 
problem before I really realised it!  I guess I should have searched for 
active issues on this before posting. 

Eagerly awaiting an announcement on completion....

Cheers,
Felix

Christopher Lenz wrote:

> 
> see http://projects.edgewall.com/trac/wiki/FineGrainedPermissions
> 

Trac 0.7.1 'Argento' Release Notes
===================================
Jun 3, 2004

Edgewall Software is pleased to announce, Trac 0.7.1 'Argento'.

Trac is a minimalistic web-based software project management and 
bug/issue tracking system. It provides an interface to the Subversion
revision control systems, an integrated wiki, flexible issue tracking
and convenient report facilities.

Trac allows wiki markup in issue descriptions and commit messages,
creating links and useful structure between bugs, tasks, changesets,
files and wiki pages.  A timeline view presents all project events in
chronological order, making tracking progress or getting an overview of
a project easy.

For more information, please visit the main Trac web site:

   <http://trac.edgewall.com/>

The software, published under the GNU General Public License, is
available at:

   <http://projects.edgewall.com/trac/download/>

Please report problems and provide feedback in the project issue
tracker:

   <http://projects.edgewall.com/trac/>

For questions, comments and user discussions, please use the Trac
mailing list. List information, subscription and archive available at:

   <http://projects.edgewall.com/trac/wiki/MailingList>

What's New
----------
0.7.1 'Argento' is primarily a bug-fix release for 0.7. Also included in
this release is experimental support for running Trac in mod_python.
This allows higher performance and shorter response-times, especially
when serving many concurrent users.

A summary of major changes for this release:

  * Bugfixes for 0.7
  * Fixes security hole in auth.py
  * Experimental support for mod_python
  * Added support for more MIME-types

For a more complete list of improvements, see the ChangeLog at:

  <http://projects.edgewall.com/trac/wiki/ChangeLog>

About Edgewall
--------------
Edgewall Software is an independent software development company
specialized in Linux and open source technologies. Edgewall provides
software development capabilities and consultancy to clients worldwide,
on both short term basis and in long term strategic partnerships.

Specific areas of expertise include:

     * Python development, including Python extensions and integration.
     * Web services and application development.
     * C and C++ application development for UNIX and Linux.
     * Cross-platform application development and porting.
     * Open Source development practices, methods and tools.

Edgewall also offers professional Trac support and consulting, including
customization, integration and custom feature development.

For more information, visit our web site at <http://www.edgewall.com/>
or email us at <mailto:info@...>.

Acknowledgements
----------------
Many thanks to the growing number of people who have, and continue to,
support the project. Also our thanks to all people providing feedback
and bug reports that helps us make Trac better, easier to use and more
effective.

Without your invaluable help, Trac would not evolve. Thank you.

Finally, we hope Trac will prove itself useful to like-minded
programmers around the world, and that this release will prove an
improvement over the last.

Please let us know. 

/The Trac Team <http://trac.edgewall.com/>
--

-- 
Jonas Borgström    | Edgewall Software
jonas@... | Professional GNU/Linux & Open Source Consulting.
                    | http://www.edgewall.com/

Mon	Tue	Wed	Thu	Fri	Sat	Sun

	1	2	3	4	5	6
7	8	9	10	11	12	13
14	15	16	17	18	19	20
21	22	23	24	25	26	27
28	29	30

67	May 2013
129	April 2013
119	March 2013
106	February 2013
116	January 2013
114	December 2012
131	November 2012
174	October 2012
192	September 2012
182	August 2012
167	July 2012
139	June 2012
104	May 2012
98	April 2012
134	March 2012
160	February 2012
140	January 2012
128	December 2011
140	November 2011
108	October 2011
118	September 2011
135	August 2011
89	July 2011
157	June 2011
224	May 2011
190	April 2011
160	March 2011
192	February 2011
184	January 2011
133	December 2010
146	November 2010
193	October 2010
233	September 2010
247	August 2010
305	July 2010
354	June 2010
345	May 2010
201	April 2010
282	March 2010
202	February 2010
333	January 2010
162	December 2009
273	November 2009
348	October 2009
334	September 2009
323	August 2009
394	July 2009
467	June 2009
433	May 2009
464	April 2009
395	March 2009
457	February 2009
430	January 2009
273	December 2008
417	November 2008
479	October 2008
355	September 2008
585	August 2008
524	July 2008
690	June 2008
531	May 2008
515	April 2008
362	March 2008
455	February 2008
367	January 2008
369	December 2007
589	November 2007
537	October 2007
504	September 2007
525	August 2007
518	July 2007
427	June 2007
431	May 2007
557	April 2007
492	March 2007
393	February 2007
443	January 2007
432	December 2006
607	November 2006
688	October 2006
674	September 2006
575	August 2006
445	July 2006
356	June 2006
283	May 2006
440	April 2006
513	March 2006
346	February 2006
479	January 2006
423	December 2005
394	November 2005
305	October 2005
511	September 2005
546	August 2005
385	July 2005
246	June 2005
438	May 2005
279	April 2005
477	March 2005
277	February 2005
338	January 2005
201	December 2004
229	November 2004
174	October 2004
145	September 2004
132	August 2004
113	July 2004
95	June 2004
157	May 2004
57	April 2004
97	March 2004

RE: Assign-to: field

ACL & group

Creating multiple Trac projects

RE: Creating multiple Trac projects

Re: Creating multiple Trac projects

Trac Repository Browser bypasses SVN permissions

Re: Trac Repository Browser bypasses SVN permissions

Diff on Windows & Viewing .BAS files in browser

Re: Trac Repository Browser bypasses SVN permissions

Trac 0.7.1 Released