Mercurial > p > roundup > code
comparison doc/upgrading.txt @ 5113:cf112b90fa8d
issue2550855: added search perms for anonymous to the user class.
This lets the "show unassigned" search work for anonymous.
Patch by Stuart McGraw.
Added warning to upgrading.txt and a comment block before the schema
change in every template tracker except minimal (doesn't have the
search).
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Thu, 30 Jun 2016 21:08:15 -0400 |
| parents | 67fad01d2009 |
| children | 722394a48d7b |
comparison
equal
deleted
inserted
replaced
| 5112:8901cc4ef0e0 | 5113:cf112b90fa8d |
|---|---|
| 116 | 116 |
| 117 If your deployed tracker is based on: classic, minimal, responsive or | 117 If your deployed tracker is based on: classic, minimal, responsive or |
| 118 devel templates and has not changed the html/_generic.404.html file, | 118 devel templates and has not changed the html/_generic.404.html file, |
| 119 you can copy in the new file to get this additional functionality. | 119 you can copy in the new file to get this additional functionality. |
| 120 | 120 |
| 121 Schema change to allow "Show Unassigned" issues link to work for Anonymous user | |
| 122 ------------------------------------------------------------------------------- | |
| 123 | |
| 124 In this release the anonymous user is allowed to search the user | |
| 125 class. The following was added to the schema for all templates that | |
| 126 provide the search option:: | |
| 127 | |
| 128 p = db.security.addPermission(name='Search', klass='user') | |
| 129 db.security.addPermissionToRole ('Anonymous', p) | |
| 130 | |
| 131 If you are running a tracker that **does not** allow read access for | |
| 132 anonymous, you should remove this entry as it can be used to perform | |
| 133 a username guessing attack against a roundup install. | |
| 121 | 134 |
| 122 Migrating from 1.5.0 to 1.5.1 | 135 Migrating from 1.5.0 to 1.5.1 |
| 123 ============================= | 136 ============================= |
| 124 | 137 |
| 125 User data visibility | 138 User data visibility |