Anonymous user can browse source without permission

mjs

unread,

Sep 30, 2015, 4:48:05 PM9/30/15

to Trac Users

I have a Trac page and Subversion repository that I want to permit access to only for authenticated users. In the permission list, anonymous doesn't appear, so I presume it is supposed to have no permissions. Anonymous users can't access any Trac pages without logging in, but even for users not logged in, the Browse Source button appears on the "You are not logged in" page, and anonymous users can click the link and view the Subversion repo contents.

How can I block that access? I tried to 'permission remove anonymous BROWSER_VIEW' but anonymous doesn't have that permission.

I'm using the account_manager plugin and my Subversion access control files as the group_file, authz_file, and htpasswd_file. The permission_policies are AuthzSourcePolicy, DefaultPermissionPolicy, LegacyAttachmentPolicy, and the permission_store is DefaultPermissionStore. Any other information I need to supply?

TIA.

Matthew Saltzman
Clemson University Math Sciences

mjs

unread,

Sep 30, 2015, 5:04:25 PM9/30/15

to Trac Users

One other piece of information: In the authz_file, the repository has entry

[Repo:/]
* =
@groupname = rw

Ryan Ollos

unread,

Sep 30, 2015, 5:24:38 PM9/30/15

to Trac Users

Could you try removing AuthzSourcePolicy from permission_policies? It would be good to isolate the issue to that permission policy.

What Trac version are you running?

mjs

unread,

Oct 1, 2015, 4:36:35 PM10/1/15

to Trac Users, ryan.j...@gmail.com

On Wednesday, September 30, 2015 at 5:24:38 PM UTC-4, RjOllos wrote:

Could you try removing AuthzSourcePolicy from permission_policies? It would be good to isolate the issue to that permission policy.

Removing AuthzSourcePolicy does remove the Browse Source button when not authenticated.

What Trac version are you running?

1.0.8

Ryan Ollos

unread,

Oct 1, 2015, 4:45:20 PM10/1/15

to mjs, Trac Users

On Thu, Oct 1, 2015 at 1:36 PM, mjs <m...@clemson.edu> wrote:

On Wednesday, September 30, 2015 at 5:24:38 PM UTC-4, RjOllos wrote:

Could you try removing AuthzSourcePolicy from permission_policies? It would be good to isolate the issue to that permission policy.

Removing AuthzSourcePolicy does remove the Browse Source button when not authenticated.

I'm not able to reproduce with Trac 1.0.8.

Have you checked that anonymous is not a member of another permission group?

For example, I've revoked all permissions from anonymous. Then, when I add anonymous to the authenticated permission group, anonymous inherits all the permissions from that permission group.

(browser-test)~/Documents/Workspace/trac-dev/browser-test$trac-admin trac permission list anonymous

User Action

------------

Available actions:

BROWSER_VIEW, CHANGESET_VIEW, CONFIG_VIEW, EMAIL_VIEW, FILE_VIEW,

LOG_VIEW, MILESTONE_ADMIN, MILESTONE_CREATE, MILESTONE_DELETE,

MILESTONE_MODIFY, MILESTONE_VIEW, PERMISSION_ADMIN, PERMISSION_GRANT,

PERMISSION_REVOKE, REPORT_ADMIN, REPORT_CREATE, REPORT_DELETE,

REPORT_MODIFY, REPORT_SQL_VIEW, REPORT_VIEW, ROADMAP_ADMIN, ROADMAP_VIEW,

SEARCH_VIEW, TICKET_ADMIN, TICKET_APPEND, TICKET_BATCH_MODIFY,

TICKET_CHGPROP, TICKET_CREATE, TICKET_EDIT_CC, TICKET_EDIT_COMMENT,

TICKET_EDIT_DESCRIPTION, TICKET_MODIFY, TICKET_VIEW, TIMELINE_VIEW,

TRAC_ADMIN, VERSIONCONTROL_ADMIN, WIKI_ADMIN, WIKI_CREATE, WIKI_DELETE,

WIKI_MODIFY, WIKI_RENAME, WIKI_VIEW

(browser-test)~/Documents/Workspace/trac-dev/browser-test$trac-admin trac permission add anonymous authenticated

(browser-test)~/Documents/Workspace/trac-dev/browser-test$trac-admin trac permission list anonymous

User Action

-------------------------

anonymous TICKET_APPEND

anonymous TICKET_CHGPROP

anonymous TICKET_CREATE

anonymous TICKET_MODIFY

anonymous WIKI_CREATE

anonymous WIKI_MODIFY