Mercurial > p > roundup > code
comparison website/issues/schema.py @ 4902:a403c29ffaf9
Security fix default user permissions
Default user permissions should not include all user attributes. We now
limit this to the username, realname and some further attributes
depending on the schema. Note that we no longer include the email
addresses, depending on your installation you may want to further
restrict this or add some attributes like ``address`` and
``alternate_addresses``.
| author | Ralf Schlatterbeck <rsc@runtux.com> |
|---|---|
| date | Fri, 04 Jul 2014 15:32:28 +0200 |
| parents | a4dc087f3088 |
| children | 276fe92c81c9 |
comparison
equal
deleted
inserted
replaced
| 4901:fa268ea457db | 4902:a403c29ffaf9 |
|---|---|
| 257 db.security.addPermissionToRole('Coordinator', 'Edit', cl) | 257 db.security.addPermissionToRole('Coordinator', 'Edit', cl) |
| 258 db.security.addPermissionToRole('Coordinator', 'Create', cl) | 258 db.security.addPermissionToRole('Coordinator', 'Create', cl) |
| 259 | 259 |
| 260 db.security.addPermissionToRole('Coordinator', 'SB: May Classify') | 260 db.security.addPermissionToRole('Coordinator', 'SB: May Classify') |
| 261 | 261 |
| 262 # May users view other user information? Comment these lines out | 262 # Allow Users and Developers to view most user properties. |
| 263 # if you don't want them to | 263 p = db.security.addPermission(name='View', klass='user', |
| 264 db.security.addPermissionToRole('User', 'View', 'user') | 264 properties=('id', 'username', 'address', 'realname', 'phone', |
| 265 db.security.addPermissionToRole('Developer', 'View', 'user') | 265 'organisation', 'alternate_addresses', 'timezone')) |
| 266 db.security.addPermissionToRole('User', p) | |
| 267 db.security.addPermissionToRole('Developer', p) | |
| 268 # Coordinator may view all user properties. | |
| 266 db.security.addPermissionToRole('Coordinator', 'View', 'user') | 269 db.security.addPermissionToRole('Coordinator', 'View', 'user') |
| 267 | 270 |
| 268 # Allow Coordinator to edit any user, including their roles. | 271 # Allow Coordinator to edit any user, including their roles. |
| 269 db.security.addPermissionToRole('Coordinator', 'Edit', 'user') | 272 db.security.addPermissionToRole('Coordinator', 'Edit', 'user') |
| 270 db.security.addPermissionToRole('Coordinator', 'Web Roles') | 273 db.security.addPermissionToRole('Coordinator', 'Web Roles') |