0

I have multiple projects in TRAC. I'm using mod_wsgi, and my wsgi script file TRAC_ENV_PARENT_DIR variable is pointing to the folder containing folders with all these projects. A few users have access to different projects. When a user visits the TRAC URL, she can see the listing containing all these projects, yet has no access to some of them. Is there any way to show to a user only those projects this user has access to? Please advise.

Andrew
  • 71
  • 6
  • My answer is still rather generic, because it would require to know more about your setup and requirements to give more specific advice. Please comment as required. – hasienda Jun 10 '12 at 11:40

2 Answers2

0

Preamble: I abhor security through obscurity. Your request could be read as cosmetics in web site presentation. Don't aim at improved access control, because knowing a valid path will still give access to each Trac environment depending on it's settings. Of course better navigation is a good reason.

Requiring to hide folders depending on user's permission means you require authentication before granting access to TRAC_ENV_PARENT_DIR. This could be done with standard mechanisms that your web server supports. This is just the precondition.

As you say, you have some non-public Trac instances in your Trac environment folder collection. How complicated it is to identify all folders correctly, that depends on how much you want to spend on initial implementation vs. maintenance.

I should be trivial, but error-prone, to provide a list of either the public or the private directories, of course whatever is easier to maintain. Zero additional configuration would require to open each Trac environment and look up user permissions. )** This sounds rather cumbersome and means probably a performance penalty for applications with large user base and frequent access. You will at least work with a cached list, if you go down this road.

You can't use Trac's auto-generated Available projects list but you'll have to deliver at least two versions of an index page for authenticated/unprivileged and authenticated and privileged users.

For the sake of maintenability you'll want to consolitate configuration and permissions. For access to each Trac environment you could use trac.ini inheritance and a shared .htpasswd file. However you can't inherit permissions, because these settings are stored inside the Trac db. You could give TracUserSyncPlugin a shot, but it seems not yet fit for production, or at least lacks feedback of all the happy users, if they exist.

)** While I'm not aware of dedicated documentation about this, there are actually several possibilities. Since permissions are stored in the Trac db, all involve reading/querying the permission db table. It's structure is documented with all other tables of the Trac db schema. To read you'll want to open the Trac environment(s) and then use a direct query on the table (see a AccountManagerPlugin changeset for an example) or construct and query a PermissionCache object.

hasienda
  • 2,390
  • 1
  • 13
  • 16
  • Thank you for your answer! It's not security through obscurity. The TRAC administrator sets permissions for every registered user. The TRAC uses SSL and HTTP basic authentication using htpasswd. However the list still contains all the projects for every authenticated user. It would be easier if there were only public and private projects, but I was thinking rather about different persons having access to different projects. I was thinking about making the front page (the Available projects page) by myself. – Andrew Jun 12 '12 at 07:08
  • Could you please point me to some documentation on how to read permissions for different projects for the TRAC users? It would be much appreciated. – Andrew Jun 12 '12 at 07:09
  • I've edited my answer to give you some hints on the matter, hope this helps a bit further on. – hasienda Jun 13 '12 at 18:46
0

It may be an old question, but so far i've found the answers to be rather complex without need.

I think using the information stated here, http://trac.edgewall.org/wiki/TracInterfaceCustomization#ProjectList , one could build a template that checks for users and permissions and then show the data it should.

In my case, i just needed to point the "TRAC_ENV_INDEX_TEMPLATE" variable to blank HTML, and that was enough for me.

Daniel Cantarin
  • 319
  • 3
  • 7