kolan
/
obsolete.ChilliProject
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[#619] Restrict anonymous read access with Redmine.pm 

Redmine.pm now also checks for public projects whether the anonymous
user has the browse_repository right for a read operation.
This commit is contained in:
Holger Just 2011-10-04 17:17:31 +02:00
parent e7f69d4236
commit 8fb8cd0ee5
1 changed files with 24 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
extra/svn/Redmine.pm
View File

@ -318,7 +318,7 @@ sub access_handler {
my $project_id = get_project_identifier($r);
$r->set_handlers(PerlAuthenHandler => [\&OK])
if is_public_project($project_id, $r);
if is_public_project($project_id, $r) && anonymous_role_allows_browse_repository($r);
return OK
}
@ -390,6 +390,29 @@ sub is_public_project {
$ret;
}
sub anonymous_role_allows_browse_repository {
my $r = shift;
my $dbh = connect_database($r);
my $sth = $dbh->prepare(
"SELECT permissions FROM roles WHERE builtin = 2;"
);
$sth->execute();
my $ret = 0;
if (my @row = $sth->fetchrow_array) {
if ($row[0] =~ /:browse_repository/) {
$ret = 1;
}
}
$sth->finish();
undef $sth;
$dbh->disconnect();
undef $dbh;
$ret;
}
# perhaps we should use repository right (other read right) to check public access.
# it could be faster BUT it doesn't work for the moment.
# sub is_public_project_by_file {