Creation of Groups and Privledges

[Ron-115]

I'm currently in the process of testing Bugzilla at work and trying to get
the last couple of pieces in place.  I would like to create 2 groups and
give them the appropriate privileges.

Dev Group
This group has the ability to change the status of a bug from New to
Assigned or Resolved; regardless if they initially reported the bug.

QA Group
This group would have the same privileges as Dev plus they have the ability
to mark a bug as verified or closed.

Currently I'm using the editbugs group, but want to learn how to restrict
the rights of users....

Thanks,
Ron


_______________________________________________
support-bugzilla mailing list
support-bugzilla@...
https://lists.mozilla.org/listinfo/support-bugzilla
PLEASE put support-bugzilla@... in the To: field when you reply.

[Gervase Markham]

On 03/11/09 01:59, Ron wrote:
> Currently I'm using the editbugs group, but want to learn how to restrict
> the rights of users....

You need to edit check_can_change_field(); grep will tell you where it
is, as I don't know offhand :-)

Gev
_______________________________________________
support-bugzilla mailing list
support-bugzilla@...
https://lists.mozilla.org/listinfo/support-bugzilla
PLEASE put support-bugzilla@... in the To: field when you reply.

[Ron-115]

Hi Gev,
First, thanks for taking the time to reply and for the hint about what to
look for.  I'm extremely new to Bugzilla and haven't ever used Perl before.
Additionally, the IT department didn't want to support a Linux box so I had
to install Bugzilla on Windows Server 2008......

Here is what I understand about Groups; please correct me if I'm wrong.

When groups are initially created (Administration > Groups) there isn't
anything special about them; ie, they can only inherent permissions from the
default groups.  If you want to specify "special" permissions than rules
will have to be added in other files.

I created a group named Development and used the default Group Permissions.
The test user is only in this group and is in no other groups.  In
C:\Bugzilla\Bugzilla I edited Bug.PM and added the following line in the
following section:

################################################################################
# check_can_change_field() defines what users are allowed to change. You
# can add code here for site-specific policy changes, according to the
# instructions given in the Bugzilla Guide and below. Note that you may also
# have to update the Bugzilla::Bug::user() function to give people access to
the
# options that they are permitted to change.
#
# check_can_change_field() returns true if the user is allowed to change
this
# field, and false if they are not.
#
# The parameters to this method are as follows:
# $field    - name of the field in the bugs table the user is trying to
change
# $oldvalue - what they are changing it from
# $newvalue - what they are changing it to
# $PrivilegesRequired - return the reason of the failure, if any
################################################################################
sub check_can_change_field {

.

.

.

#this is the part I added

# Allows Development group to only change open status; they cannot
close/verify them

if ($user->in_group('Development ', $self->{'bug_status'})) {
   return 1;
}

#end of what  I added.  This is  to show where I added the new lines......

.

.

.

    # If we haven't returned by this point, then the user doesn't
    # have the necessary permissions to change this field.
    $$PrivilegesRequired = 1;
    return 0;
}

#
# Field Validation
#.

.

.

.

.After I made the change I ran checksetup.pl (didn't know if I had to) but
it didn't work as what I hoped it would.

So my questions are:

1. Did I code it correctly?

2. Did I put the code in the correct location in the file or was it the
wrong file?

3. Is there any information on this topic?  So far I found the following
items; but obviously these didn't complete solve my issue :).

http://groups.google.com/group/mozilla.support.bugzilla/msg/a88e29649557deb5
http://markmail.org/message/yqigrlifkm5kx2mm#query:check_can_change_field%28%29%3B+page:1+mid:hfpof7wjve6zfvjw+state:results

Thanks,

Ron


_______________________________________________
support-bugzilla mailing list
support-bugzilla@...
https://lists.mozilla.org/listinfo/support-bugzilla
PLEASE put support-bugzilla@... in the To: field when you reply.

[Gervase Markham]

On 06/11/09 03:46, Ron wrote:
> First, thanks for taking the time to reply and for the hint about what to
> look for.  I'm extremely new to Bugzilla and haven't ever used Perl before.

That might make things a bit trickier. A glance at a Perl primer is
probably a good idea.

> When groups are initially created (Administration > Groups) there isn't
> anything special about them; ie, they can only inherent permissions from the
> default groups.  If you want to specify "special" permissions than rules
> will have to be added in other files.

I don't quite understand this statement.

Groups are groups. You can have inherited membership ("I'm in GroupA and
therefore I'm considered to be in GroupB") but not "inherited
permissions". I don't know what you mean by "special permissions" or
"being special".

> # The parameters to this method are as follows:
> # $field    - name of the field in the bugs table the user is trying to
> change
> # $oldvalue - what they are changing it from
> # $newvalue - what they are changing it to
> # $PrivilegesRequired - return the reason of the failure, if any
> ################################################################################
> sub check_can_change_field {
>
> .
>
> .
>
> .
>
> #this is the part I added
>
> # Allows Development group to only change open status; they cannot
> close/verify them
>
> if ($user->in_group('Development ', $self->{'bug_status'})) {
>    return 1;
> }

Why are you passing two parameters to the in_group function?

You want something like:

if ($user->in_group('Development') &&
    $field eq "bug_status" &&
    !is_open_state($newvalue))
{
   # Development can't change status unless to an open value
   $PrivilegesRequired = 3;
   return 0;
}

If you need to make further changes, I suggest you read a bit more about
perl, a bit more about the comments in that file, make sure you
understand the other code in that subroutine (the bit about canconfirm
would have been a better starting point) and a bit more of the code of
the functions you are calling so you know how to call them :-)

Sadly, there's no way to do a GUI interface for this, because people's
requirements are just so varied.

Gerv
_______________________________________________
support-bugzilla mailing list
support-bugzilla@...
https://lists.mozilla.org/listinfo/support-bugzilla
PLEASE put support-bugzilla@... in the To: field when you reply.