X-Git-Url: https://git.tokkee.org/?a=blobdiff_plain;f=doc%2Fupgrading.txt;h=acdef4697db074b08936759a463d4054d869f06e;hb=bdcb21234cae9e506c37cbe90bc52803d5cc7c4e;hp=a2248720c61b1ed39ddf551be877582939aae4a0;hpb=b0f2ca592bed213b669cb22f308125ebabbddba1;p=roundup.git diff --git a/doc/upgrading.txt b/doc/upgrading.txt index a224872..acdef46 100644 --- a/doc/upgrading.txt +++ b/doc/upgrading.txt @@ -13,9 +13,169 @@ steps. .. contents:: +Migrating from 1.4.x to 1.4.17 +============================== + +Searching now requires either read-permission without a check method, or +you will have to add a "Search" permission for a class or a list of +properties for a class (if you want to allow searching). For the classic +template (or other templates derived from it) you want to add the +following lines to your `schema.py` file:: + + p = db.security.addPermission(name='Search', klass='query') + db.security.addPermissionToRole('User', p) + +This is needed, because for the `query` class users may view only their +own queries (or public queries). This is implemented with a `check` +method, therefore the default search permissions will not allow +searching and you'll have to add an explicit search permission. +If you have modified your schema, you can check if you're missing any +search permissions with the following script, run it in your tracker +directory, it will list for each Class and Property the roles that may +search for this property:: + + #!/usr/bin/python + import os + from roundup import instance + + tracker = instance.open(os.getcwd ()) + db = tracker.open('admin') + + for cl in sorted(db.getclasses()): + print "Class:", cl + for p in sorted(db.getclass(cl).properties.keys()): + print " Property:", p + roles = [] + for role in sorted(db.security.role.iterkeys()): + if db.security.roleHasSearchPermission(role,cl,p): + roles.append(role) + print " roles may search:", ', '.join(roles) + + +Migrating from 1.4.x to 1.4.12 +============================== + +Item creation now checks the "Create" permission instead of the "Edit" +permission for individual properties. If you have modified your tracker +permissions from the default distribution, you should check that +"Create" permissions exist for all properties you want users to be able +to create. + + +Fixing some potential security holes +------------------------------------ + +Enhanced checking was added to the user registration auditor. If you +run a public tracker you should update your tracker's +``detectors/userauditor.py`` using the new code from +``share/roundup/templates/classic/detectors/userauditor.py``. In most +cases you may just copy the file over, but if you've made changes to +the auditor in your tracker then you'll need to manually integrate +the new code. + +Some HTML templates were found to have formatting security problems: + +``html/page.html``:: + + -tal:replace="request/user/username">username
+ +tal:replace="python:request.user.username.plain(escape=1)">username
+ +``html/_generic.help-list.html``:: + + -tal:content="structure python:item[prop]"> + +tal:content="python:item[prop]"> + +The lines marked "+" should be added and lines marked "-" should be +deleted (minus the "+"/"-" signs). + + +Some HTML interface tweaks +-------------------------- + +You may wish to copy the ``user_utils.js`` and ``style.css` files from the +source distribution ``share/roundup/templates/classic/html/`` directory to the +``html`` directory of your trackers as it includes a small improvement. + +If you have made local changes to those files you'll need to manually work +the differences in to your versions or ignore the changes. + + +Migrating from 1.4.x to 1.4.11 +============================== + +Close potential security hole +----------------------------- + +If your tracker has untrusted users you should examine its ``schema.py`` +file and look for the section granting the "Edit" permission to your users. +This should look something like:: + + p = db.security.addPermission(name='Edit', klass='user', check=own_record, + description="User is allowed to edit their own user details") + +and should be modified to restrict the list of properties they are allowed +to edit by adding the ``properties=`` section like:: + + p = db.security.addPermission(name='Edit', klass='user', check=own_record, + properties=('username', 'password', 'address', 'realname', 'phone', + 'organisation', 'alternate_addresses', 'queries', 'timezone'), + description="User is allowed to edit their own user details") + +Most importantly the "roles" property should not be editable - thus not +appear in that list of properties. + + +Grant the "Register" permission to the Anonymous role +----------------------------------------------------- + +A separate "Register" permission has been introduced to allow +anonymous users to register. This means you will need to add the +following to your tracker's ``schema.py`` to add the permission and +assign it to the Anonymous role (replacing any previously assigned +"Create user" permission for the Anonymous role):: + + +db.security.addPermission(name='Register', klass='user', + + description='User is allowed to register new user') + + # Assign the appropriate permissions to the anonymous user's Anonymous + # Role. Choices here are: + # - Allow anonymous users to register + -db.security.addPermissionToRole('Anonymous', 'Create', 'user') + +db.security.addPermissionToRole('Anonymous', 'Register', 'user') + +The lines marked "+" should be added and lines marked "-" should be +deleted (minus the "+"/"-" signs). + +You should also modify the ``html/page.html`` template to change the +permission tested there:: + + -tal:condition="python:request.user.hasPermission('Create', 'user')" + +tal:condition="python:request.user.hasPermission('Register', 'user')" + + +Generic class editor may now restore retired items +-------------------------------------------------- + +The instructions for doing so won't be present in your tracker unless you copy +the ``_generic.index.html`` template from the roundup distribution in +``share/roundup/templates/classic/html`` to your tracker's ``html`` directory. + + Migrating from 1.4.x to 1.4.9 ============================= +Customized MailGW Class +----------------------- + +If you have customized the MailGW class in your tracker: The new MailGW +class opens the database for each message in the method handle_message +(instance.open) instead of passing the opened database as a parameter to +the MailGW constructor. The old handle_message has been renamed to +_handle_message. The new method opens the database and wraps the call to +the old method into a try/finally. + +Your customized MailGW class needs to mirror this behavior. + Fix the "remove" button in issue files and messages lists --------------------------------------------------------- @@ -94,7 +254,7 @@ The lines marked "+" should be added, minus the "+" sign. Fix the "retire" link in the users list for admin users ------------------------------------------------------- -The "retire" link found in the file ``html/users.index.html``:: +The "retire" link found in the file ``html/user.index.html``::