-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 28.09.2012 23:11, Olemis Lang wrote:
> with all respect ... afaics I'd not use this because it seems to me
> that they do not respect Trac permissions and other access control
> mechanisms . Saved reports are the way to go because they are under
> the umbrella of some permission checks afaicr REPORT_CREATE ,
> REPORT_SQL_EDIT . Hence only privileged users decide what will be
> repots contents and what not .
You're right, I've just checked that now.
For Trac db tables you have a point. In general ReportModule is an
interesting, valid approach. OTOH it might still be too limited for some
folks, as I already told in my last reply. And the missing
permission/access control could be added rather easily, even reusing
existing permission.
Note that we have
trac.wiki.api.IWikiPageManipulator - Allows plugins to validate wiki
pages prior to that they get stored in the database.
So we could reject a wiki page with an embedded SQL macro done by the
"wrong" person.
In general contributions are welcome, but it seems to me like we've
already gone the fork-n-add way a bit too long. While it's easy to throw
out a new hack, maintaining and improving it over the years is a major
quality criteria from my point of view.
These days a couple of developers struggle hard to consolidate existing
hacks list, and anyone building on-top of existing code, maybe
integrating different related solutions into a more feature-rice one
helps to ease the pain of going over dozens of likely unmaintained heaps
of code.
Steffen Hoffmann
iEYEARECAAYFAlBmLt4ACgkQ31DJeiZFuHeIwwCfbalQMsRGnlAQT/HYz1uMrXdT
DD8AoMi/GHPAke38r32nRCr0m3ZIv2Jv
=s4gB
-----END PGP SIGNATURE-----