jro_apps/redmine Commit - r1789:f5f51f4f832d

Add write control on repository from Redmine interface...

Nicolas Chuche -

r1789:f5f51f4f832d

parent child

Context file:

r1789:f5f51f4f832d

Collapse all files

db/migrate/20080827185639_add_repository_write_access.rb created 644 +14 0

@@ -0,0 +1,14
	1	class AddRepositoryWriteAccess < ActiveRecord::Migration
	2
	3	def self.up
	4	Role.find(:all).select { \|r\| not r.builtin? }.each do \|r\|
	5	r.add_permission!(:commit_access)
	6	end
	7	end
	8
	9	def self.down
	10	Role.find(:all).select { \|r\| not r.builtin? }.each do \|r\|
	11	r.remove_permission!(:commit_access)
	12	end
	13	end
	14	end

app/models/role.rb +20 -2

             # redMine - project management software
             # Copyright (C) 2006  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class Role < ActiveRecord::Base
               # Built-in roles
               BUILTIN_NON_MEMBER = 1
               BUILTIN_ANONYMOUS  = 2
               before_destroy :check_deletable
               has_many :workflows, :dependent => :delete_all do
                 def copy(role)
                   raise "Can not copy workflow from a #{role.class}" unless role.is_a?(Role)
                   raise "Can not copy workflow from/to an unsaved role" if proxy_owner.new_record? || role.new_record?
                   clear
                   connection.insert "INSERT INTO workflows (tracker_id, old_status_id, new_status_id, role_id)" +
                                     " SELECT tracker_id, old_status_id, new_status_id, #{proxy_owner.id}" +
                                     " FROM workflows" +
                                     " WHERE role_id = #{role.id}"
                 end
               end
               has_many :members
               acts_as_list
-              serialize :permissions
+              serialize :permissions, Array
               attr_protected :builtin
               validates_presence_of :name
               validates_uniqueness_of :name
               validates_length_of :name, :maximum => 30
               validates_format_of :name, :with => /^[\w\s\'\-]*$/i
               def permissions
                 read_attribute(:permissions) || []
               end
               def permissions=(perms)
-                perms = perms.collect {|p| p.to_sym unless p.blank? }.compact if perms
+                perms = perms.collect {|p| p.to_sym unless p.blank? }.compact.uniq if perms
                 write_attribute(:permissions, perms)
               end
+              def add_permission!(*perms)
+                self.permissions = [] unless permissions.is_a?(Array)
+                permissions_will_change!
+                perms.each do |p|
+                  p = p.to_sym
+                  permissions << p unless permissions.include?(p)
+                end
+                save!
+              end
+              def remove_permission!(*perms)
+                return unless permissions.is_a?(Array)
+                permissions_will_change!
+                perms.each { |p| permissions.delete(p.to_sym) }
+                save!
+              end
               def <=>(role)
                 position <=> role.position
               end
               # Return true if the role is a builtin role
               def builtin?
                 self.builtin != 0
               end
               # Return true if the role is a project member role
               def member?
                 !self.builtin?
               end
               # Return true if role is allowed to do the specified action
               # action can be:
               # * a parameter-like Hash (eg. :controller => 'projects', :action => 'edit')
               # * a permission Symbol (eg. :edit_project)
               def allowed_to?(action)
                 if action.is_a? Hash
                   allowed_actions.include? "#{action[:controller]}/#{action[:action]}"
                 else
                   allowed_permissions.include? action
                 end
               end
               # Return all the permissions that can be given to the role
               def setable_permissions
                 setable_permissions = Redmine::AccessControl.permissions - Redmine::AccessControl.public_permissions
                 setable_permissions -= Redmine::AccessControl.members_only_permissions if self.builtin == BUILTIN_NON_MEMBER
                 setable_permissions -= Redmine::AccessControl.loggedin_only_permissions if self.builtin == BUILTIN_ANONYMOUS
                 setable_permissions
               end
               # Find all the roles that can be given to a project member
               def self.find_all_givable
                 find(:all, :conditions => {:builtin => 0}, :order => 'position')
               end
               # Return the builtin 'non member' role
               def self.non_member
                 find(:first, :conditions => {:builtin => BUILTIN_NON_MEMBER}) || raise('Missing non-member builtin role.')
               end
               # Return the builtin 'anonymous' role
               def self.anonymous
                 find(:first, :conditions => {:builtin => BUILTIN_ANONYMOUS}) || raise('Missing anonymous builtin role.')
               end
             private
               def allowed_permissions
                 @allowed_permissions ||= permissions + Redmine::AccessControl.public_permissions.collect {|p| p.name}
               end
               def allowed_actions
                 @actions_allowed ||= allowed_permissions.inject([]) { |actions, permission| actions += Redmine::AccessControl.allowed_actions(permission) }.flatten
               end
               def check_deletable
                 raise "Can't delete role" if members.any?
                 raise "Can't delete builtin role" if builtin?
               end
             end

extra/svn/Redmine.pm +9 -6

             package Apache::Authn::Redmine;
             =head1 Apache::Authn::Redmine
             Redmine - a mod_perl module to authenticate webdav subversion users
             against redmine database
             =head1 SYNOPSIS
             This module allow anonymous users to browse public project and
             registred users to browse and commit their project. Authentication is
             done against the redmine database or the LDAP configured in redmine.
             This method is far simpler than the one with pam_* and works with all
             database without an hassle but you need to have apache/mod_perl on the
             svn server.
             =head1 INSTALLATION
             For this to automagically work, you need to have a recent reposman.rb
             (after r860) and if you already use reposman, read the last section to
             migrate.
             Sorry ruby users but you need some perl modules, at least mod_perl2,
             DBI and DBD::mysql (or the DBD driver for you database as it should
             work on allmost all databases).
             On debian/ubuntu you must do :
               aptitude install libapache-dbi-perl libapache2-mod-perl2 libdbd-mysql-perl
             If your Redmine users use LDAP authentication, you will also need
             Authen::Simple::LDAP (and IO::Socket::SSL if LDAPS is used):
               aptitude install libauthen-simple-ldap-perl libio-socket-ssl-perl
             =head1 CONFIGURATION
                ## This module has to be in your perl path
                ## eg:  /usr/lib/perl5/Apache/Authn/Redmine.pm
                PerlLoadModule Apache::Authn::Redmine
                <Location /svn>
                  DAV svn
                  SVNParentPath "/var/svn"
                  AuthType Basic
                  AuthName redmine
                  Require valid-user
                  PerlAccessHandler Apache::Authn::Redmine::access_handler
                  PerlAuthenHandler Apache::Authn::Redmine::authen_handler
                  ## for mysql
                  RedmineDSN "DBI:mysql:database=databasename;host=my.db.server"
                  ## for postgres
                  # RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server"
                  RedmineDbUser "redmine"
                  RedmineDbPass "password"
                  ## Optional where clause (fulltext search would be slow and
                  ## database dependant).
                  # RedmineDbWhereClause "and members.role_id IN (1,2)"
                  ## Optional credentials cache size
                  # RedmineCacheCredsMax 50
               </Location>
             To be able to browse repository inside redmine, you must add something
             like that :
                <Location /svn-private>
                  DAV svn
                  SVNParentPath "/var/svn"
                  Order deny,allow
                  Deny from all
                  # only allow reading orders
                  <Limit GET PROPFIND OPTIONS REPORT>
                    Allow from redmine.server.ip
                  </Limit>
                </Location>
             and you will have to use this reposman.rb command line to create repository :
               reposman.rb --redmine my.redmine.server --svn-dir /var/svn --owner www-data -u http://svn.server/svn-private/
             =head1 MIGRATION FROM OLDER RELEASES
             If you use an older reposman.rb (r860 or before), you need to change
             rights on repositories to allow the apache user to read and write
             S<them :>
               sudo chown -R www-data /var/svn/*
               sudo chmod -R u+w /var/svn/*
             And you need to upgrade at least reposman.rb (after r860).
             =cut
             use strict;
             use warnings FATAL => 'all', NONFATAL => 'redefine';
             use DBI;
             use Digest::SHA1;
             # optional module for LDAP authentication
             my $CanUseLDAPAuth = eval("use Authen::Simple::LDAP; 1");
             use Apache2::Module;
             use Apache2::Access;
             use Apache2::ServerRec qw();
             use Apache2::RequestRec qw();
             use Apache2::RequestUtil qw();
             use Apache2::Const qw(:common :override :cmd_how);
             use APR::Pool ();
             use APR::Table ();
             # use Apache2::Directive qw();
             my @directives = (
               {
                 name => 'RedmineDSN',
                 req_override => OR_AUTHCFG,
                 args_how => TAKE1,
                 errmsg => 'Dsn in format used by Perl DBI. eg: "DBI:Pg:dbname=databasename;host=my.db.server"',
               },
               {
                 name => 'RedmineDbUser',
                 req_override => OR_AUTHCFG,
                 args_how => TAKE1,
               },
               {
                 name => 'RedmineDbPass',
                 req_override => OR_AUTHCFG,
                 args_how => TAKE1,
               },
               {
                 name => 'RedmineDbWhereClause',
                 req_override => OR_AUTHCFG,
                 args_how => TAKE1,
               },
               {
                 name => 'RedmineCacheCredsMax',
                 req_override => OR_AUTHCFG,
                 args_how => TAKE1,
                 errmsg => 'RedmineCacheCredsMax must be decimal number',
               },
             );
             sub RedmineDSN {
               my ($self, $parms, $arg) = @_;
               $self->{RedmineDSN} = $arg;
               my $query = "SELECT
-                             hashed_password, auth_source_id
+                             hashed_password, auth_source_id, permissions
-                          FROM members, projects, users
+                          FROM members, projects, users, roles
                           WHERE
                             projects.id=members.project_id
                             AND users.id=members.user_id
+                            AND roles.id=members.role_id
                             AND users.status=1
                             AND login=?
                             AND identifier=? ";
               $self->{RedmineQuery} = trim($query);
             }
             sub RedmineDbUser { set_val('RedmineDbUser', @_); }
             sub RedmineDbPass { set_val('RedmineDbPass', @_); }
             sub RedmineDbWhereClause {
               my ($self, $parms, $arg) = @_;
               $self->{RedmineQuery} = trim($self->{RedmineQuery}.($arg ? $arg : "")." ");
             }
             sub RedmineCacheCredsMax {
               my ($self, $parms, $arg) = @_;
               if ($arg) {
                 $self->{RedmineCachePool} = APR::Pool->new;
                 $self->{RedmineCacheCreds} = APR::Table::make($self->{RedmineCachePool}, $arg);
                 $self->{RedmineCacheCredsCount} = 0;
                 $self->{RedmineCacheCredsMax} = $arg;
               }
             }
             sub trim {
               my $string = shift;
               $string =~ s/\s{2,}/ /g;
               return $string;
             }
             sub set_val {
               my ($key, $self, $parms, $arg) = @_;
               $self->{$key} = $arg;
             }
             Apache2::Module::add(__PACKAGE__, \@directives);
             my %read_only_methods = map { $_ => 1 } qw/GET PROPFIND REPORT OPTIONS/;
             sub access_handler {
               my $r = shift;
               unless ($r->some_auth_required) {
                   $r->log_reason("No authentication has been configured");
                   return FORBIDDEN;
               }
               my $method = $r->method;
               return OK unless defined $read_only_methods{$method};
               my $project_id = get_project_identifier($r);
               $r->set_handlers(PerlAuthenHandler => [\&OK])
                   if is_public_project($project_id, $r);
               return OK
             }
             sub authen_handler {
               my $r = shift;
               my ($res, $redmine_pass) =  $r->get_basic_auth_pw();
               return $res unless $res == OK;
               if (is_member($r->user, $redmine_pass, $r)) {
                   return OK;
               } else {
                   $r->note_auth_failure();
                   return AUTH_REQUIRED;
               }
             }
             sub is_public_project {
                 my $project_id = shift;
                 my $r = shift;
                 my $dbh = connect_database($r);
                 my $sth = $dbh->prepare(
                     "SELECT * FROM projects WHERE projects.identifier=? and projects.is_public=true;"
                 );
                 $sth->execute($project_id);
                 my $ret = $sth->fetchrow_array ? 1 : 0;
                 $sth->finish();
                 $dbh->disconnect();
                 $ret;
             }
             # perhaps we should use repository right (other read right) to check public access.
             # it could be faster BUT it doesn't work for the moment.
             # sub is_public_project_by_file {
             #     my $project_id = shift;
             #     my $r = shift;
             #     my $tree = Apache2::Directive::conftree();
             #     my $node = $tree->lookup('Location', $r->location);
             #     my $hash = $node->as_hash;
             #     my $svnparentpath = $hash->{SVNParentPath};
             #     my $repos_path = $svnparentpath . "/" . $project_id;
             #     return 1 if (stat($repos_path))[2] & 00007;
             # }
             sub is_member {
               my $redmine_user = shift;
               my $redmine_pass = shift;
               my $r = shift;
               my $dbh         = connect_database($r);
               my $project_id  = get_project_identifier($r);
               my $pass_digest = Digest::SHA1::sha1_hex($redmine_pass);
               my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
               my $usrprojpass;
               if ($cfg->{RedmineCacheCredsMax}) {
                 $usrprojpass = $cfg->{RedmineCacheCreds}->get($redmine_user.":".$project_id);
                 return 1 if (defined $usrprojpass and ($usrprojpass eq $pass_digest));
               }
               my $query = $cfg->{RedmineQuery};
               my $sth = $dbh->prepare($query);
               $sth->execute($redmine_user, $project_id);
               my $ret;
-              while (my @row = $sth->fetchrow_array) {
+              while (my ($hashed_password, $auth_source_id, $permissions) = $sth->fetchrow_array) {
-                  unless ($row[1]) {
-                      if ($row[0] eq $pass_digest) {
+                  unless ($auth_source_id) {
+            	  my $method = $r->method;
+                      if ($hashed_password eq $pass_digest && (defined $read_only_methods{$method} || $permissions =~ /:commit_access/) ) {
                           $ret = 1;
                           last;
                       }
                   } elsif ($CanUseLDAPAuth) {
                       my $sthldap = $dbh->prepare(
                           "SELECT host,port,tls,account,account_password,base_dn,attr_login from auth_sources WHERE id = ?;"
                       );
-                      $sthldap->execute($row[1]);
+                      $sthldap->execute($auth_source_id);
                       while (my @rowldap = $sthldap->fetchrow_array) {
                         my $ldap = Authen::Simple::LDAP->new(
                             host    =>      ($rowldap[2] == 1 || $rowldap[2] eq "t") ? "ldaps://$rowldap[0]" : $rowldap[0],
                             port    =>      $rowldap[1],
                             basedn  =>      $rowldap[5],
                             binddn  =>      $rowldap[3] ? $rowldap[3] : "",
                             bindpw  =>      $rowldap[4] ? $rowldap[4] : "",
                             filter  =>      "(".$rowldap[6]."=%s)"
                         );
                         $ret = 1 if ($ldap->authenticate($redmine_user, $redmine_pass));
                       }
                       $sthldap->finish();
                   }
               }
               $sth->finish();
               $dbh->disconnect();
               if ($cfg->{RedmineCacheCredsMax} and $ret) {
                 if (defined $usrprojpass) {
                   $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id, $pass_digest);
                 } else {
                   if ($cfg->{RedmineCacheCredsCount} < $cfg->{RedmineCacheCredsMax}) {
                     $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id, $pass_digest);
                     $cfg->{RedmineCacheCredsCount}++;
                   } else {
                     $cfg->{RedmineCacheCreds}->clear();
                     $cfg->{RedmineCacheCredsCount} = 0;
                   }
                 }
               }
               $ret;
             }
             sub get_project_identifier {
                 my $r = shift;
                 my $location = $r->location;
                 my ($identifier) = $r->uri =~ m{$location/*([^/]+)};
                 $identifier;
             }
             sub connect_database {
                 my $r = shift;
                 my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
                 return DBI->connect($cfg->{RedmineDSN}, $cfg->{RedmineDbUser}, $cfg->{RedmineDbPass});
             }
 ;

lib/redmine.rb +1 0

             require 'redmine/access_control'
             require 'redmine/menu_manager'
             require 'redmine/activity'
             require 'redmine/mime_type'
             require 'redmine/core_ext'
             require 'redmine/themes'
             require 'redmine/hook'
             require 'redmine/plugin'
             begin
               require_library_or_gem 'RMagick' unless Object.const_defined?(:Magick)
             rescue LoadError
               # RMagick is not available
             end
             REDMINE_SUPPORTED_SCM = %w( Subversion Darcs Mercurial Cvs Bazaar Git Filesystem )
             # Permissions
             Redmine::AccessControl.map do |map|
               map.permission :view_project, {:projects => [:show, :activity]}, :public => true
               map.permission :search_project, {:search => :index}, :public => true
               map.permission :edit_project, {:projects => [:settings, :edit]}, :require => :member
               map.permission :select_project_modules, {:projects => :modules}, :require => :member
               map.permission :manage_members, {:projects => :settings, :members => [:new, :edit, :destroy]}, :require => :member
               map.permission :manage_versions, {:projects => [:settings, :add_version], :versions => [:edit, :destroy]}, :require => :member
               map.project_module :issue_tracking do |map|
                 # Issue categories
                 map.permission :manage_categories, {:projects => [:settings, :add_issue_category], :issue_categories => [:edit, :destroy]}, :require => :member
                 # Issues
                 map.permission :view_issues, {:projects => [:changelog, :roadmap],
                                               :issues => [:index, :changes, :show, :context_menu],
                                               :versions => [:show, :status_by],
                                               :queries => :index,
                                               :reports => :issue_report}, :public => true
                 map.permission :add_issues, {:issues => :new}
                 map.permission :edit_issues, {:issues => [:edit, :reply, :bulk_edit, :destroy_attachment]}
                 map.permission :manage_issue_relations, {:issue_relations => [:new, :destroy]}
                 map.permission :add_issue_notes, {:issues => [:edit, :reply]}
                 map.permission :edit_issue_notes, {:journals => :edit}, :require => :loggedin
                 map.permission :edit_own_issue_notes, {:journals => :edit}, :require => :loggedin
                 map.permission :move_issues, {:issues => :move}, :require => :loggedin
                 map.permission :delete_issues, {:issues => :destroy}, :require => :member
                 # Queries
                 map.permission :manage_public_queries, {:queries => [:new, :edit, :destroy]}, :require => :member
                 map.permission :save_queries, {:queries => [:new, :edit, :destroy]}, :require => :loggedin
                 # Gantt & calendar
                 map.permission :view_gantt, :projects => :gantt
                 map.permission :view_calendar, :projects => :calendar
                 # Watchers
                 map.permission :view_issue_watchers, {}
                 map.permission :add_issue_watchers, {:watchers => :new}
               end
               map.project_module :time_tracking do |map|
                 map.permission :log_time, {:timelog => :edit}, :require => :loggedin
                 map.permission :view_time_entries, :timelog => [:details, :report]
                 map.permission :edit_time_entries, {:timelog => [:edit, :destroy]}, :require => :member
                 map.permission :edit_own_time_entries, {:timelog => [:edit, :destroy]}, :require => :loggedin
               end
               map.project_module :news do |map|
                 map.permission :manage_news, {:news => [:new, :edit, :destroy, :destroy_comment]}, :require => :member
                 map.permission :view_news, {:news => [:index, :show]}, :public => true
                 map.permission :comment_news, {:news => :add_comment}
               end
               map.project_module :documents do |map|
                 map.permission :manage_documents, {:documents => [:new, :edit, :destroy, :add_attachment, :destroy_attachment]}, :require => :loggedin
                 map.permission :view_documents, :documents => [:index, :show, :download]
               end
               map.project_module :files do |map|
                 map.permission :manage_files, {:projects => :add_file, :versions => :destroy_file}, :require => :loggedin
                 map.permission :view_files, :projects => :list_files, :versions => :download
               end
               map.project_module :wiki do |map|
                 map.permission :manage_wiki, {:wikis => [:edit, :destroy]}, :require => :member
                 map.permission :rename_wiki_pages, {:wiki => :rename}, :require => :member
                 map.permission :delete_wiki_pages, {:wiki => :destroy}, :require => :member
                 map.permission :view_wiki_pages, :wiki => [:index, :history, :diff, :annotate, :special]
                 map.permission :edit_wiki_pages, :wiki => [:edit, :preview, :add_attachment, :destroy_attachment]
                 map.permission :protect_wiki_pages, {:wiki => :protect}, :require => :member
               end
               map.project_module :repository do |map|
                 map.permission :manage_repository, {:repositories => [:edit, :destroy]}, :require => :member
                 map.permission :browse_repository, :repositories => [:show, :browse, :entry, :annotate, :changes, :diff, :stats, :graph]
                 map.permission :view_changesets, :repositories => [:show, :revisions, :revision]
+                map.permission :commit_access, {}
               end
               map.project_module :boards do |map|
                 map.permission :manage_boards, {:boards => [:new, :edit, :destroy]}, :require => :member
                 map.permission :view_messages, {:boards => [:index, :show], :messages => [:show]}, :public => true
                 map.permission :add_messages, {:messages => [:new, :reply, :quote]}
                 map.permission :edit_messages, {:messages => :edit}, :require => :member
                 map.permission :delete_messages, {:messages => :destroy}, :require => :member
               end
             end
             Redmine::MenuManager.map :top_menu do |menu|
               menu.push :home, :home_path, :html => { :class => 'home' }
               menu.push :my_page, { :controller => 'my', :action => 'page' }, :html => { :class => 'mypage' }, :if => Proc.new { User.current.logged? }
               menu.push :projects, { :controller => 'projects', :action => 'index' }, :caption => :label_project_plural, :html => { :class => 'projects' }
               menu.push :administration, { :controller => 'admin', :action => 'index' }, :html => { :class => 'admin' }, :if => Proc.new { User.current.admin? }, :last => true
               menu.push :help, Redmine::Info.help_url, :html => { :class => 'help' }, :last => true
             end
             Redmine::MenuManager.map :account_menu do |menu|
               menu.push :login, :signin_path, :html => { :class => 'login' }, :if => Proc.new { !User.current.logged? }
               menu.push :register, { :controller => 'account', :action => 'register' }, :html => { :class => 'register' }, :if => Proc.new { !User.current.logged? && Setting.self_registration? }
               menu.push :my_account, { :controller => 'my', :action => 'account' }, :html => { :class => 'myaccount' }, :if => Proc.new { User.current.logged? }
               menu.push :logout, :signout_path, :html => { :class => 'logout' }, :if => Proc.new { User.current.logged? }
             end
             Redmine::MenuManager.map :application_menu do |menu|
               # Empty
             end
             Redmine::MenuManager.map :project_menu do |menu|
               menu.push :overview, { :controller => 'projects', :action => 'show' }
               menu.push :activity, { :controller => 'projects', :action => 'activity' }
               menu.push :roadmap, { :controller => 'projects', :action => 'roadmap' },
                           :if => Proc.new { |p| p.versions.any? }
               menu.push :issues, { :controller => 'issues', :action => 'index' }, :param => :project_id, :caption => :label_issue_plural
               menu.push :new_issue, { :controller => 'issues', :action => 'new' }, :param => :project_id, :caption => :label_issue_new,
                           :html => { :accesskey => Redmine::AccessKeys.key_for(:new_issue) }
               menu.push :news, { :controller => 'news', :action => 'index' }, :param => :project_id, :caption => :label_news_plural
               menu.push :documents, { :controller => 'documents', :action => 'index' }, :param => :project_id, :caption => :label_document_plural
               menu.push :wiki, { :controller => 'wiki', :action => 'index', :page => nil },
                           :if => Proc.new { |p| p.wiki && !p.wiki.new_record? }
               menu.push :boards, { :controller => 'boards', :action => 'index', :id => nil }, :param => :project_id,
                           :if => Proc.new { |p| p.boards.any? }, :caption => :label_board_plural
               menu.push :files, { :controller => 'projects', :action => 'list_files' }, :caption => :label_attachment_plural
               menu.push :repository, { :controller => 'repositories', :action => 'show' },
                           :if => Proc.new { |p| p.repository && !p.repository.new_record? }
               menu.push :settings, { :controller => 'projects', :action => 'settings' }, :last => true
             end
             Redmine::Activity.map do |activity|
               activity.register :issues, :class_name => %w(Issue Journal)
               activity.register :changesets
               activity.register :news
               activity.register :documents, :class_name => %w(Document Attachment)
               activity.register :files, :class_name => 'Attachment'
               activity.register :wiki_pages, :class_name => 'WikiContent::Version', :default => false
               activity.register :messages, :default => false
             end

lib/redmine/default_data/loader.rb +2 -1

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             module Redmine
               module DefaultData
                 class DataAlreadyLoaded < Exception; end
                 module Loader
                   include GLoc
                   class << self
                     # Returns true if no data is already loaded in the database
                     # otherwise false
                     def no_data?
                       !Role.find(:first, :conditions => {:builtin => 0}) &&
                         !Tracker.find(:first) &&
                         !IssueStatus.find(:first) &&
                         !Enumeration.find(:first)
                     end
                     # Loads the default data
                     # Raises a RecordNotSaved exception if something goes wrong
                     def load(lang=nil)
                       raise DataAlreadyLoaded.new("Some configuration data is already loaded.") unless no_data?
                       set_language_if_valid(lang)
                       Role.transaction do
                         # Roles
                         manager = Role.create! :name => l(:default_role_manager),
                                                :position => 1
                         manager.permissions = manager.setable_permissions.collect {|p| p.name}
                         manager.save!
                         developper = Role.create! :name => l(:default_role_developper),
                                                   :position => 2,
                                                   :permissions => [:manage_versions,
                                                                   :manage_categories,
                                                                   :add_issues,
                                                                   :edit_issues,
                                                                   :manage_issue_relations,
                                                                   :add_issue_notes,
                                                                   :save_queries,
                                                                   :view_gantt,
                                                                   :view_calendar,
                                                                   :log_time,
                                                                   :view_time_entries,
                                                                   :comment_news,
                                                                   :view_documents,
                                                                   :view_wiki_pages,
                                                                   :edit_wiki_pages,
                                                                   :delete_wiki_pages,
                                                                   :add_messages,
                                                                   :view_files,
                                                                   :manage_files,
                                                                   :browse_repository,
-                                                                  :view_changesets]
+                                                                  :view_changesets,
+                                                                  :commit_access]
                         reporter = Role.create! :name => l(:default_role_reporter),
                                                 :position => 3,
                                                 :permissions => [:add_issues,
                                                                 :add_issue_notes,
                                                                 :save_queries,
                                                                 :view_gantt,
                                                                 :view_calendar,
                                                                 :log_time,
                                                                 :view_time_entries,
                                                                 :comment_news,
                                                                 :view_documents,
                                                                 :view_wiki_pages,
                                                                 :add_messages,
                                                                 :view_files,
                                                                 :browse_repository,
                                                                 :view_changesets]
                         Role.non_member.update_attribute :permissions, [:add_issues,
                                                                         :add_issue_notes,
                                                                         :save_queries,
                                                                         :view_gantt,
                                                                         :view_calendar,
                                                                         :view_time_entries,
                                                                         :comment_news,
                                                                         :view_documents,
                                                                         :view_wiki_pages,
                                                                         :add_messages,
                                                                         :view_files,
                                                                         :browse_repository,
                                                                         :view_changesets]
                         Role.anonymous.update_attribute :permissions, [:view_gantt,
                                                                        :view_calendar,
                                                                        :view_time_entries,
                                                                        :view_documents,
                                                                        :view_wiki_pages,
                                                                        :view_files,
                                                                        :browse_repository,
                                                                        :view_changesets]
                         # Trackers
                         Tracker.create!(:name => l(:default_tracker_bug),     :is_in_chlog => true,  :is_in_roadmap => false, :position => 1)
                         Tracker.create!(:name => l(:default_tracker_feature), :is_in_chlog => true,  :is_in_roadmap => true,  :position => 2)
                         Tracker.create!(:name => l(:default_tracker_support), :is_in_chlog => false, :is_in_roadmap => false, :position => 3)
                         # Issue statuses
                         new       = IssueStatus.create!(:name => l(:default_issue_status_new), :is_closed => false, :is_default => true, :position => 1)
                         assigned  = IssueStatus.create!(:name => l(:default_issue_status_assigned), :is_closed => false, :is_default => false, :position => 2)
                         resolved  = IssueStatus.create!(:name => l(:default_issue_status_resolved), :is_closed => false, :is_default => false, :position => 3)
                         feedback  = IssueStatus.create!(:name => l(:default_issue_status_feedback), :is_closed => false, :is_default => false, :position => 4)
                         closed    = IssueStatus.create!(:name => l(:default_issue_status_closed), :is_closed => true, :is_default => false, :position => 5)
                         rejected  = IssueStatus.create!(:name => l(:default_issue_status_rejected), :is_closed => true, :is_default => false, :position => 6)
                         # Workflow
                         Tracker.find(:all).each { |t|
                           IssueStatus.find(:all).each { |os|
                             IssueStatus.find(:all).each { |ns|
                               Workflow.create!(:tracker_id => t.id, :role_id => manager.id, :old_status_id => os.id, :new_status_id => ns.id) unless os == ns
                             }
                           }
                         }
                         Tracker.find(:all).each { |t|
                           [new, assigned, resolved, feedback].each { |os|
                             [assigned, resolved, feedback, closed].each { |ns|
                               Workflow.create!(:tracker_id => t.id, :role_id => developper.id, :old_status_id => os.id, :new_status_id => ns.id) unless os == ns
                             }
                           }
                         }
                         Tracker.find(:all).each { |t|
                           [new, assigned, resolved, feedback].each { |os|
                             [closed].each { |ns|
                               Workflow.create!(:tracker_id => t.id, :role_id => reporter.id, :old_status_id => os.id, :new_status_id => ns.id) unless os == ns
                             }
                           }
                           Workflow.create!(:tracker_id => t.id, :role_id => reporter.id, :old_status_id => resolved.id, :new_status_id => feedback.id)
                         }
                         # Enumerations
                         Enumeration.create!(:opt => "DCAT", :name => l(:default_doc_category_user), :position => 1)
                         Enumeration.create!(:opt => "DCAT", :name => l(:default_doc_category_tech), :position => 2)
                         Enumeration.create!(:opt => "IPRI", :name => l(:default_priority_low), :position => 1)
                         Enumeration.create!(:opt => "IPRI", :name => l(:default_priority_normal), :position => 2, :is_default => true)
                         Enumeration.create!(:opt => "IPRI", :name => l(:default_priority_high), :position => 3)
                         Enumeration.create!(:opt => "IPRI", :name => l(:default_priority_urgent), :position => 4)
                         Enumeration.create!(:opt => "IPRI", :name => l(:default_priority_immediate), :position => 5)
                         Enumeration.create!(:opt => "ACTI", :name => l(:default_activity_design), :position => 1)
                         Enumeration.create!(:opt => "ACTI", :name => l(:default_activity_development), :position => 2)
                       end
                       true
                     end
                   end
                 end
               end
             end

test/unit/role_test.rb +20 0

             # redMine - project management software
             # Copyright (C) 2006-2008  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.dirname(__FILE__) + '/../test_helper'
             class RoleTest < Test::Unit::TestCase
               fixtures :roles, :workflows
               def test_copy_workflows
                 source = Role.find(1)
                 assert_equal 90, source.workflows.size
                 target = Role.new(:name => 'Target')
                 assert target.save
                 target.workflows.copy(source)
                 target.reload
                 assert_equal 90, target.workflows.size
               end
+              def test_add_permission
+                role = Role.find(1)
+                size = role.permissions.size
+                role.add_permission!("apermission", "anotherpermission")
+                role.reload
+                assert role.permissions.include?(:anotherpermission)
+                assert_equal size + 2, role.permissions.size
+              end
+              def test_remove_permission
+                role = Role.find(1)
+                size = role.permissions.size
+                perm = role.permissions[0..1]
+                role.remove_permission!(*perm)
+                role.reload
+                assert ! role.permissions.include?(perm[0])
+                assert_equal size - 2, role.permissions.size
+              end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages