Skip to content

Commit

Permalink
Fix comments and documentation
Browse files Browse the repository at this point in the history
  • Loading branch information
@cproensa
cproensa committed Feb 4, 2020
1 parent c6acfe2 commit 0e1c34c
Show file tree
Hide file tree
Showing 5 changed files with 123 additions and 81 deletions.
2 changes: 1 addition & 1 deletion bug_actiongroup.php
View file
Expand Up @@ -158,7 +158,7 @@
$t_threshold = access_get_status_threshold( $t_assign_status, $t_bug->project_id );
if( access_has_bug_level( config_get( 'update_bug_assign_threshold', config_get( 'update_bug_threshold' ) ), $t_bug_id ) ) {
# The new handler is checked at project level
if(access_has_project_level( config_get( 'handle_bug_threshold' ), $t_bug->project_id, $f_assign ) ) {
if( access_has_project_level( config_get( 'handle_bug_threshold' ), $t_bug->project_id, $f_assign ) ) {
if( bug_check_workflow( $t_status, $t_assign_status ) ) {
# @todo we need to issue a helper_call_custom_function( 'issue_update_validate', array( $t_bug_id, $t_bug_data, $f_bugnote_text ) );
bug_assign( $t_bug_id, $f_assign, $f_bug_notetext, $f_bug_noteprivate );
Expand Down
8 changes: 4 additions & 4 deletions config_defaults_inc.php
View file
Expand Up @@ -3050,15 +3050,15 @@
* bugs that they report.
* This feature is deprecated and is replaced with the option 'limit_view_unless_threshold'.
* Set this option as OFF to be able to use the new one.
* @see $g_limit_view_unless_threshold
* @deprecated 2.23.0 Use $g_limit_view_unless_threshold instead
* @global integer $g_limit_reporters
*/
$g_limit_reporters = OFF;

/**
* Threshold at wich a user can view all issues in the project (as allowed by other permissions)
* Not meeting this threshold means the user can only see the issues reported, handled, or
* monitored by him.
* Threshold at which a user can view all issues in the project (as allowed by other permissions)
* Not meeting this threshold means the user can only see the issues they reported,
* are handling or monitoring.
* A value of ANYBODY means that all users have full visibility (as default)
*
* This is a replacement for old option 'limit_reporters'.
Expand Down
18 changes: 11 additions & 7 deletions core/access_api.php
View file
Expand Up @@ -509,14 +509,14 @@ function access_has_bug_level( $p_access_level, $p_bug_id, $p_user_id = null ) {
return false;
}

# Check the requested access level, shotcut to fail if not satisfied
# Check the requested access level, shortcut to fail if not satisfied
$t_project_id = bug_get_field( $p_bug_id, 'project_id' );
$t_access_level = access_get_project_level( $t_project_id, $p_user_id );
if( !access_compare_level( $t_access_level, $p_access_level ) ){
return false;
}

# If the level is met, we need to still verify access to the issue
# If the level is met, we still need to verify that user has access to the issue

# Check if the bug is private
$t_bug_is_user_reporter = bug_is_user_reporter( $p_bug_id, $p_user_id );
Expand Down Expand Up @@ -896,11 +896,14 @@ function access_parse_array( array $p_access ) {
}

/**
* Returns true if the user is limited for viewing issues, in the specified project,
* accordint to 'limit_reporters' options
* Returns true if the user has limited view to issues in the specified project.
*
* @param integer $p_project_id Project id, or null for current project
* @param integer $p_user_id User id, or null for current user
* @return boolean Whether limited view applies
*
* @see $g_limit_view_unless_threshold
* @see $g_limit_reporters
*/
function access_has_limited_view( $p_project_id = null, $p_user_id = null ) {
$t_user_id = ( null === $p_user_id ) ? auth_get_current_user_id() : $p_user_id;
Expand All @@ -913,8 +916,9 @@ function access_has_limited_view( $p_project_id = null, $p_user_id = null ) {
if( ON != $t_old_limit_reporters ) {
$t_threshold_can_view = config_get( 'limit_view_unless_threshold', null, $t_user_id, $t_project_id );
} else {
# If old 'limit_reporters' option is enabled, use that setting
# Note that the effective threshold can vary for each project, based on the reporting threshold configuration.
# If old 'limit_reporters' option is enabled, use that setting
# Note that the effective threshold can vary for each project, based on
# the reporting threshold configuration.
# To improve performance, esp. when processing for several projects, we
# build a static array holding that threshold for each project
static $s_thresholds = array();
Expand All @@ -931,4 +935,4 @@ function access_has_limited_view( $p_project_id = null, $p_user_id = null ) {

$t_project_level = access_get_project_level( $p_project_id, $p_user_id );
return !access_compare_level( $t_project_level, $t_threshold_can_view );
}
}
43 changes: 30 additions & 13 deletions core/classes/BugFilterQuery.class.php
View file
Expand Up @@ -538,26 +538,36 @@ protected function build_projects() {
return;
}

# Arrays for project visibility conditions. Each array will translate to a set of conditions for visibility.
# Based on the user access level, each project will be placed in one or several of these arrays for later treatment.
# Arrays for project visibility conditions. Each array will translate
# to a set of conditions for visibility.
# Based on the user access level, each project will be placed in one
# or several of these arrays for later treatment.

# this array is populated with projects that the current user has full access to (public and private issues)
# this array is populated with projects that the current user
# hasfull access to (public and private issues)
$t_private_and_public_project_ids = array();
# this array is populated with projects to search only public issues.
$t_public_only_project_ids = array();
# this array is populated with projects to search only accesible private issues by being the reporter of those.
# this array is populated with projects to search only accesible private
# issues by being the reporter of those.
$t_private_is_reporter_project_ids = array();

# these arrays are populated with projects where the user has limited view, with 'limit_view_unless_threshold' configuration
# these arrays are populated with projects where the user has limited view,
# with 'limit_view_unless_threshold' configuration

# projects where the user has limited view, but can see any private issue
$t_limited_public_and_private_project_ids = array();
# projects where the user has limited view, and can't see private issues, only public ones
# projects where the user has limited view, and can't see private issues,
# only public ones
$t_limited_public_only_project_ids = array();

# these arrays are populated with projects where the user has limited view with the old 'limit_reporters' configuration
# these arrays are populated with projects where the user has limited view,
# with the old 'limit_reporters' configuration

# projects where the user has limited view, but can see any private issue
$t_old_limit_public_and_private_project_ids = array();
# projects where the user has limited view, and can't see private issues, only public ones
# projects where the user has limited view, and can't see private issues,
# only public ones
$t_old_limit_public_only_project_ids = array();

# make sure the project rows are cached, as they will be used to check access levels.
Expand All @@ -583,7 +593,8 @@ protected function build_projects() {
$t_limited_public_and_private_project_ids[] = $t_pid;
} else {
$t_limited_public_only_project_ids[] = $t_pid;
# private issues can be seen by the reporter, which is also a valid case for the limited view configuration
# private issues can be seen by the reporter, which is also a valid
# case for the limited view configuration
$t_private_is_reporter_project_ids[] = $t_pid;
}
}
Expand Down Expand Up @@ -632,20 +643,26 @@ protected function build_projects() {

# for these projects, search any issue (public or private) valid for limited view
if( !empty( $t_limited_public_and_private_project_ids ) ) {
$t_query_projects_or[] = $this->sql_in( '{bug}.project_id', $t_limited_public_and_private_project_ids ) . ' AND ('
$t_query_projects_or[] = $this->sql_in( '{bug}.project_id', $t_limited_public_and_private_project_ids )
. ' AND ('
. ' {bug}.reporter_id = ' . $this->param( $t_user_id )
. ' OR {bug}.handler_id = ' . $this->param( $t_user_id )
. ' OR EXISTS ( SELECT 1 FROM {bug_monitor} bm WHERE bm.user_id = ' . $this->param( $t_user_id ) . ' AND bm.bug_id = {bug}.id )'
. ' OR EXISTS ( SELECT 1 FROM {bug_monitor} bm'
. ' WHERE bm.user_id = ' . $this->param( $t_user_id )
. ' AND bm.bug_id = {bug}.id )'
. ' )';
}

# for these projects, search public issues valid for limited view
if( !empty( $t_limited_public_only_project_ids ) ) {
$t_query_projects_or[] = $this->sql_in( '{bug}.project_id', $t_limited_public_only_project_ids )
. ' AND {bug}.view_state = ' . $this->param( VS_PUBLIC ) . ' AND ('
. ' AND {bug}.view_state = ' . $this->param( VS_PUBLIC )
. ' AND ('
. ' {bug}.reporter_id = ' . $this->param( $t_user_id )
. ' OR {bug}.handler_id = ' . $this->param( $t_user_id )
. ' OR EXISTS ( SELECT 1 FROM {bug_monitor} bm WHERE bm.user_id = ' . $this->param( $t_user_id ) . ' AND bm.bug_id = {bug}.id )'
. ' OR EXISTS ( SELECT 1 FROM {bug_monitor} bm'
. ' WHERE bm.user_id = ' . $this->param( $t_user_id )
. ' AND bm.bug_id = {bug}.id )'
. ' )';
}

Expand Down
133 changes: 77 additions & 56 deletions docbook/Admin_Guide/en-US/config/issues.xml
View file
Expand Up @@ -6,114 +6,135 @@
<section id="admin.config.issues" lang="en-US">
<title>Issues visibility</title>
<para>
By default, all issues are visible to any user within a project. To limit the visibility of issues there are several mechanisms.
By default, all issues are visible to any user within a project. To limit
the visibility of issues there are several mechanisms.
</para>
<section id="admin.config.issues.private">
<title>Public/Private view status</title>
<para>
A view status flag can be set, for an issue, to be either public or private. Private issues are accesible by the user who created it, and by those users that meet a threshold defined in <literal>$g_private_bug_threshold</literal>.
<para>
A view status flag can be set, for an issue, to be either public or
private. Private issues are accesible by the user who created it,
and by those users that meet a threshold defined in
<literal>$g_private_bug_threshold</literal>.
</para>
<para>
Refer to the following configuration options related to issue view status configurations:
<para>
Refer to the following configuration options related to issue view
status configurations:
</para>
<variablelist>
<variablelist>
<varlistentry>
<term>$g_default_bug_view_status</term>
<listitem>
<para>
The default viewing status for the new bug (VS_PUBLIC or VS_PRIVATE). The default is VS_PUBLIC.
The default viewing status for the new bug (VS_PUBLIC or
VS_PRIVATE). The default is VS_PUBLIC.
</para>

</listitem>

</varlistentry>
<varlistentry>
<varlistentry>
<term>$g_private_bug_threshold</term>
<listitem>
<para>
The threshold for a user to be able to view any private issue within a project.
The threshold for a user to be able to view any private
issue within a project.
</para>

</listitem>

</varlistentry>
<varlistentry>
<varlistentry>
<term>$g_set_view_status_threshold</term>
<listitem>
<para>
The threshold for a user to be able to set an issue to Private/Public.
</para>

</listitem>

</varlistentry>
<varlistentry>
<varlistentry>
<term>$g_change_view_status_threshold</term>
<listitem>
<para>
The threshold for a user to be able to update the view status while updating an issue.
The threshold for a user to be able to update the view status
while updating an issue.
</para>

</listitem>

</varlistentry>

</variablelist>

</section>
<section id="admin.config.issues.limitreporters">
<title>"Limit reporters" configuration (deprecated)</title>
<para>
When the option <literal>$g_limit_reporters</literal> is enabled, users that are reporters in a project, or lower access level, can only see the issues they reported. Any issue reporter by other users are not accessibel by them.
</para>
<para>
The <literal>$g_limit_reporters</literal> option is supported only for ALL_PROJECTS, this means that it's a global setting that affects all projects.
</para>
<para>
Note that the definition of <emphasis>reporter</emphasis> in this context is the actual access level for which a user is able to report issues, and is determined by <literal>$g_report_bug_threshold</literal>. Additionally, that threshold can have different values in each project. Being dependant of that threshold, the behaviour of this option is not well defined when the reporting threshold is configured as discrete values with gaps, instead of a simple threshold. In that scenario, the visibilty is determined upon the minimum access level contained in the <literal>$g_report_bug_threshold</literal> access levels array.
</para>
<note>
<para>
The <literal>$g_limit_reporters</literal> option is deprecated in favour of <literal>$g_limit_view_unless_threshold</literal>. The new option will be available by default on new installations, or after disabling <literal>$g_limit_reporters</literal> if enabled in an existing instance.
</para>

</note>

</section>
<section id="admin.config.issues.limitedview">
<section id="admin.config.issues.limitedview">
<title>Limited view configuration</title>
<para>
The <literal>$g_limit_view_unless_threshold</literal> option allows to configure access limitations for users to view only those issues that they are involved with. Currently, this configuration supports the following conditions for a user to be able to view issues:
<para>
The <literal>$g_limit_view_unless_threshold</literal> option allows
the administrator to configure access limitations for users, letting
them view only those issues that they are involved with, i.e. if:
<itemizedlist>
<listitem>
<para>
The user is the reporter of the isssue.
They reported the issue,
</para>
</listitem>
<listitem>
<listitem>
<para>
The user is handling the issue.
It is assigned to them,
</para>
</listitem>
<listitem>
<listitem>
<para>
The user is monitoring the issue
Or they are monitoring the issue.
</para>
</listitem>

</itemizedlist>

</para>
<para>
This configuration option can be set individually for each project. The dafult value is ANYBODY, so this limitation is effectively disabled by default.
<para>
This configuration option can be set individually for each project.
It defaults to ANYBODY, effectively disabling the limitation (i.e.
users can see all issues).
</para>
<para>
The value for this option is an access level threshold, so that those users that meet that threshold have an unrestricted view of any issue in the project. A user that doesn't meet this threshold, will have a restricted view of only those issues in the conditions previously described.
<para>
The value for this option is an access level threshold, so that those
users that meet that threshold have an unrestricted view of any issue
in the project. A user that doesn't meet this threshold, will have
a restricted view of only those issues in the conditions previously
described.
</para>
<para>
Note that this visibility does not override other restrictions as <emphasis>private issues</emphasis> or <emphasis>pivate projects</emphasis> user assignments.
<para>
Note that this visibility does not override other restrictions as
<emphasis>private issues</emphasis> or <emphasis>pivate projects</emphasis>
user assignments.
</para>
</section>

<section id="admin.config.issues.limitreporters">
<title>"Limit reporters" configuration (deprecated)</title>
<para>
When the option <literal>$g_limit_reporters</literal> is enabled, users
that are reporters in a project, or lower access level, are only allowed
to see the issues they reported. Issues reported by other users are
not accessible by them.
</para>
<para>
This option is only supported for
ALL_PROJECTS, this means that it's a global setting that affects all projects
</para>
<para>
Note that the definition of <emphasis>reporter</emphasis> in this context
is the actual access level for which a user is able to report issues, and
is determined by <literal>$g_report_bug_threshold</literal>. Additionally,
that threshold can have different values in each project. Being dependant
on that threshold, the behaviour of this option is not well defined when
the reporting threshold is configured as discrete values with gaps, instead
of a simple threshold. In that scenario, the visibilty is determined by
the minimum access level contained in the <literal>$g_report_bug_threshold</literal>
access levels array.
</para>
<note>
<para>
This option option is deprecated in favour of
<literal>$g_limit_view_unless_threshold</literal>. The new option
will be available by default on new installations, or after disabling
<literal>$g_limit_reporters</literal> if enabled in an existing instance.
</para>

</note>
</section>

</section>

0 comments on commit 0e1c34c

Please sign in to comment.