Redmine

One possible design could be to restrict what a project manager can do from the Project Settings page. For exemple, we could disable 'modules' and 'repository' for non-admins. Very naïve solution.

Does this not come down to trusting your managers. If you don't trust them, don't make them a project manager. Create another role with suitable privileges. The default roles only allows a developer to edit versions of a project.

Perhaps an explicit 'edit repository' to go along with the 'edit modules' setting could be added.

Cheers

Russell

Perhaps an explicit 'edit repository' to go along with the 'edit modules' setting could be added.

Actually, the permission already exists, it's called Manage repository (it lets user create/destroy the project's repository).

Hi, Russel.

Does this not come down to trusting your managers.

No. For an almost infinite number of reason, trust is never an acceptable argument when speaking about privacy or security. One example to illustrate is : manager can give manager rights to other people. One other is : on common web application deployment, there is one person that administrates the hosting system, one other administrating redmine instance, and some people working on it with some privileges. Those people don't know each other. System administrator will probably use filesystem permissions to prevent redmine process from being able to visit the whole FS. But what can the redmine administrator do ? An instance is a single process with a single posix user, so it must be able to read all the repositories for all the projects. Some restriction facilities, at the redmine level, are probably missing.

Perhaps an explicit 'edit repository' to go along with the 'edit modules' setting could be added.

Isn't that what 'manage repository' permission is about ?

Hi Paul,

Just re-read your original report, and I completely miss-understood it yesterday so apologies for that. I can see the issue now.

Isn't that what 'manage repository' permission is about ?

Ah yes, missed that one, was looking at the project group at the top.

Cheers

Russell

Woot! Nice to see this is added in this manner in 3.0.0. Thanks for it.