Update problem

[Roger Oberholtzer]

I updated some stuff on the openSUSE 12.3 server running Trac and I
now get this when accessing the site:

Configuration Error

Cannot find implementation(s) of the IPermissionPolicy interface named
InternalTicketsPolicy. Please check that the Component is enabled or
update the option [trac] permission_policies in trac.ini.

The trac.log file says:

2014-12-30 11:20:06,970 Trac[chrome] WARNING: Error with navigation
contributor HudsonTracPlugin
2014-12-30 11:20:06,970 Trac[chrome] WARNING: Error with navigation
contributor DownloadsDownloads
2014-12-30 11:20:07,437 Trac[chrome] WARNING: Error with navigation
contributor RPCWeb
2014-12-30 11:20:07,437 Trac[chrome] WARNING: Error with navigation
contributor QueryModule
2014-12-30 11:20:07,437 Trac[chrome] WARNING: Error with navigation
contributor TicketModule
2014-12-30 11:20:07,437 Trac[chrome] WARNING: Error with navigation
contributor SearchModule
2014-12-30 11:20:07,438 Trac[chrome] WARNING: Error with navigation
contributor WikiModule
2014-12-30 11:20:07,438 Trac[chrome] WARNING: Error with navigation
contributor RoadmapModule
2014-12-30 11:20:07,438 Trac[chrome] WARNING: Error with navigation
contributor ReleasesModule
2014-12-30 11:20:07,439 Trac[chrome] WARNING: Error with navigation
contributor AdminModule
2014-12-30 11:20:07,439 Trac[chrome] WARNING: Error with navigation
contributor ReportModule
2014-12-30 11:20:07,439 Trac[chrome] WARNING: Error with navigation
contributor TimelineModule
2014-12-30 11:20:07,500 Trac[chrome] WARNING: Error with navigation
contributor BrowserModule
2014-12-30 11:20:07,501 Trac[chrome] WARNING: Error with navigation
contributor FullBlogModule
2014-12-30 11:20:07,502 Trac[main] ERROR: Exception caught while
post-processing request:
Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/trac/web/main.py", line 250,
in dispatch
self._post_process_request(req)
File "/usr/lib/python2.7/site-packages/trac/web/main.py", line 348,
in _post_process_request
f.post_process_request(req, *(None,)*extra_arg_count)
File "/usr/lib/python2.7/site-packages/TracWatchlistPlugin-1.0.1-py2.7.egg/tracwatchlist/plugin.py",
line 674, in post_process_request
self.realm_handler[realm].has_perm(realm, req.perm):
File "/usr/lib/python2.7/site-packages/TracWatchlistPlugin-1.0.1-py2.7.egg/tracwatchlist/api.py",
line 154, in has_perm
return realm.upper() + '_VIEW' in perm
File "/usr/lib/python2.7/site-packages/trac/perm.py", line 554, in
has_permission
return self._has_permission(action, resource)
File "/usr/lib/python2.7/site-packages/trac/perm.py", line 568, in
_has_permission
check_permission(action, perm.username, resource, perm)
File "/usr/lib/python2.7/site-packages/trac/perm.py", line 458, in
check_permission
for policy in self.policies:
File "/usr/lib/python2.7/site-packages/trac/config.py", line 779, in __get__
option=tag.tt("[%s] %s" % (self.section, self.name))))
ConfigurationError: Cannot find implementation(s) of the
<tt>IPermissionPolicy</tt> interface named
<tt>InternalTicketsPolicy</tt>. Please check that the Component is
enabled or update the option <tt>[trac] permission_policies</tt> in
trac.ini.
2014-12-30 11:20:07,502 Trac[main] WARNING: [10.209.160.46]
HTTPInternalError: 500 Configuration Error (Cannot find
implementation(s) of the <tt>IPermissionPolicy</tt> interface named
<tt>InternalTicketsPolicy</tt>. Please check that the Component is
enabled or update the option <tt>[trac] permission_policies</tt> in
trac.ini.)



There was no change to trac.ini. So I think the problem is elsewhere.
I see that Babel was updated to 1.3 and Trac to 1.0.2.


--
Roger Oberholtzer

[Roger Oberholtzer]

I disabled the watchlist plugin since it is listed in the traceback.
It made no difference. The traceback is now:

2014-12-30 11:31:44,867 Trac[main] ERROR: Exception caught while

post-processing request:
Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/trac/web/main.py", line 250,
in dispatch
self._post_process_request(req)
File "/usr/lib/python2.7/site-packages/trac/web/main.py", line 348,
in _post_process_request
f.post_process_request(req, *(None,)*extra_arg_count)

File "/usr/lib/python2.7/site-packages/TracVote-0.1.5_r0-py2.7.egg/tracvote/__init__.py",
line 197, in post_process_request
if 'VOTE_VIEW' in req.perm:

File "/usr/lib/python2.7/site-packages/trac/perm.py", line 554, in
has_permission
return self._has_permission(action, resource)
File "/usr/lib/python2.7/site-packages/trac/perm.py", line 568, in
_has_permission
check_permission(action, perm.username, resource, perm)
File "/usr/lib/python2.7/site-packages/trac/perm.py", line 458, in
check_permission
for policy in self.policies:
File "/usr/lib/python2.7/site-packages/trac/config.py", line 779, in __get__
option=tag.tt("[%s] %s" % (self.section, self.name))))

--
Roger Oberholtzer

[RjOllos]

Since Trac 1.0.2 any permission policies defined in the [trac] permission_policies section must have been loaded. This was done so that Trac will "fail closed". If a permission policy fails to load it could result in a security issue.

You appear to have a policy named InternalTicketPolicy that is not active. This could be due to a plugin that you've removed without removing the policy from permission_policies, or the plugin could be failing to load. Note the hint that is provided in the error message:

[Roger Oberholtzer]

I saw the hint and thought that since I had not changed any Trac
plugins or the Trac config that the parameters were still okay as they
had been working.

I removed that permission policy reference and the site now comes up.
Next is to see that the removal did not break anything.

Thanks. That was a quick reply!

> --
> You received this message because you are subscribed to the Google Groups
> "Trac Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to trac-users+...@googlegroups.com.
> To post to this group, send email to trac-...@googlegroups.com.
> Visit this group at http://groups.google.com/group/trac-users.
> For more options, visit https://groups.google.com/d/optout.



--
Roger Oberholtzer

[RjOllos]

On Tuesday, December 30, 2014 2:48:32 AM UTC-8, Roger Oberholtzer wrote:

I saw the hint and thought that since I had not changed any Trac
plugins or the Trac config that the parameters were still okay as they
had been working.

I gave a bit of thought as to whether to make the change on 1.0-stable or the trunk. I gave more weight to the issue being a potential security concern, and figured that users might see an error when upgrading regardless of whether it's a major or minor release.
 

I removed that permission policy reference and the site now comes up.
Next is to see that the removal did not break anything.

It looks like InternalTicketsPolicy is provided by TimingAndEstimationPlugin permissions branch:
http://trac-hacks.org/browser/timingandestimationplugin/branches/trac0.12-Permissions/timingandestimationplugin/ticket_policy.py
 

[Roger Oberholtzer]

I don't mind improvements or changed behavior. Maybe the error text
can reference information on this change so one knows there has been
such a change? My Trac release is maintained by the openSUSE Build
Service and so I get updates when I update the system in general. In
this case, the Trac and Babel updates came with a slew of other
updates. I confess I did not read the release notes of each one.
openSUSE's Build Service tends on the side of being conservative. I
have come to trust it. Bur I admit it has made me lazy with respect to
checking all changes in all things...

[Steffen Hoffmann]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 30.12.2014 12:04, RjOllos wrote:
> I gave a bit of thought as to whether to make the change on 1.0-stable
> or the trunk. I gave more weight to the issue being a potential security
> concern, and figured that users might see an error when upgrading
> regardless of whether it's a major or minor release.

I think, this was the right decision. IMHO Rogers response made clear,
that it was a problem on his side not reading changelogs and not
understanding the rather clear note.

You could hardly give clearer feedback, because instructions how to fix
the issue are already there. You don't attempt to make reading and
proper admin reaction obsolete, do you? ;-)

Steffen Hoffmann
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlSi7t8ACgkQ31DJeiZFuHdX+wCbBGSeR/Smmmq9ACIFQRocqJfV
TikAn0ScxQVVuo1oovb6A10cRzAOahtW
=LI8d
-----END PGP SIGNATURE-----