\n') # start content div - # get request parameters try: text_rows = int(form['rows'][0]) @@ -259,6 +257,8 @@ if edit_lock_message or message: self.request.write('

%s%s

' % (message, edit_lock_message)) + self.request.write('

\n') # start content div + # get the text body for the editor field if form.has_key('template'): # "template" parameter contains the name of the template page From david at dgreaves.com Mon Aug 30 08:54:16 2004 From: david at dgreaves.com (David Greaves) Date: Mon Aug 30 08:54:16 2004 Subject: [Moin-devel] [PATCH] Allow subscribers to see 'trivial' changes In-Reply-To: <20040823154435.50751.qmail@web14306.mail.yahoo.com> References: <20040823154435.50751.qmail@web14306.mail.yahoo.com> Message-ID: <41334D6C.7010702@dgreaves.com> As discussed (briefly!) recently. This patch adds a 'want_trivial' to the User object (and preferences) that indicates that the users would like to see all changes, no matter how trivial. It also sends the entire body of a page if there is no history (ie a new page). The current 'behaviour' is mimicked. In other words, if a user unticks 'Send mail notification' then it appears as if no notifications have been sent. This a) lets 'nice' users think they're not bothering people with emails about trivial changes (so they don't feel shy about correcting typos) b) may fool the abusers into thinking the admins are 'on the ball' :) c) most importantly - doesn't let abusers add p0rn links etc and stop notification emails. This applies to 1.2.3 David PS please let me know if there are any issues. Roger Haase wrote: >--- David Greaves wrote: > > >I agree with your thinking David. Tools which assist administrators in >watching a site are very beneficial. I would certainly apply your patch >if it were available. > >Roger Haase > > --- PageEditor.py.orig 2004-08-30 16:47:31.000000000 +0100 +++ PageEditor.py 2004-08-30 11:02:02.000000000 +0100 @@ -465,13 +465,14 @@ cache.remove() - def _sendNotification(self, comment, emails, email_lang, oldversions): + def _sendNotification(self, comment, emails, email_lang, oldversions, trivial): """ Send notification email for a single language. @param comment: editor's comment given when saving the page @param emails: list of email addresses @param email_lang: language of emails @param oldversions: old versions of this page + @param trivial: the change is marked as trivial @rtype: int @return: sendmail result """ @@ -493,7 +494,8 @@ # append a diff if not oldversions: mailBody = mailBody + \ - _("No older revisions of the page stored, diff not available.") + _("New page:\n") + \ + Page(self.page_name).get_raw_body() else: newpage = os.path.join(config.text_dir, wikiutil.quoteFilename(self.page_name)) oldpage = os.path.join(config.backup_dir, oldversions[0]) @@ -509,7 +511,8 @@ _('The diff function returned with error code %(rc)s!') % {'rc': rc} return util.mail.sendmail(self.request, emails, - _('[%(sitename)s] Update of "%(pagename)s"') % { + _('[%(sitename)s]%(trivial)s Update of "%(pagename)s"') % { + 'trivial' : (trivial or "") and " Trivial", 'sitename': config.sitename or "Wiki", 'pagename': self.page_name, }, @@ -517,16 +520,17 @@ # was: self.request.user.email, but we don't want to disclose email - def _notifySubscribers(self, comment): + def _notifySubscribers(self, comment, trivial): """ Send email to all subscribers of this page. @param comment: editor's comment given when saving the page + @param trivial: editor's suggestion that the change is trivial (Subscribers may ignore this) @rtype: string @return: message, indicating success or errors. """ _ = self._ - subscribers = self.getSubscribers(self.request, return_users=1) + subscribers = self.getSubscribers(self.request, return_users=1, trivial=trivial) wiki_is_smarter_than_its_users = _("You will not be notified of your own changes!") + '
' @@ -539,11 +543,18 @@ for lang in subscribers.keys(): emails = map(lambda u: u.email, subscribers[lang]) names = map(lambda u: u.name, subscribers[lang]) - mailok, status = self._sendNotification(comment, emails, lang, oldversions) + mailok, status = self._sendNotification(comment, emails, lang, oldversions, trivial) recipients = ", ".join(names) results.append(_('[%(lang)s] %(recipients)s: %(status)s') % { 'lang': lang, 'recipients': recipients, 'status': status}) + if trivial: + # lie about not sending email (so abusers think their actions are hidden) + # This is a bit inconsistent with having this as a user option - maybe reconsider u.want_trivia + # to be memberOfGroup(WantTrivia) + # FIXME also maybe make this a wiki configurable? + return _('') + return wiki_is_smarter_than_its_users + '
'.join(results) return wiki_is_smarter_than_its_users + _('Nobody subscribed to this page, no mail sent.') @@ -794,8 +805,8 @@ {'pagename': self.page_name}) # send notification mails - if config.mail_smarthost and kw.get('notify', 0): - msg = msg + self._notifySubscribers(kw.get('comment', '')) + if config.mail_smarthost: + msg = msg + self._notifySubscribers(kw.get('comment', ''), not kw.get('notify', 0)) # remove lock (forcibly if we were allowed to break it by the UI) # !!! this is a little fishy, since the lock owner might not notice --- Page.py.orig 2004-08-30 16:47:20.000000000 +0100 +++ Page.py 2004-08-30 10:09:40.000000000 +0100 @@ -333,11 +333,13 @@ @param request: the request object @keyword include_self: if 1, include current user (default: 0) @keyword return_users: if 1, return user instances (default: 0) + @keyword trivial: if 1, only include users who want trivial changes (default: 0) @rtype: dict @return: lists of subscribed email addresses in a dict by language key """ include_self = kw.get('include_self', 0) return_users = kw.get('return_users', 0) + trivial = kw.get('trivial', 0) # extract categories of this page pageList = self.getCategories(request) @@ -353,24 +355,31 @@ # get email addresses of the all wiki user which have a profile stored; # add the address only if the user has subscribed to the page and # the user is not the current editor + # Also, if the change is trivial (send email isn't ticked) only send email to users + # who want_trivial changes (typically Admins on public sites) userlist = user.getUserList() - emails = {} + subscriber_list = {} for uid in userlist: if uid == request.user.id and not include_self: continue # no self notification subscriber = user.User(request, uid) - if not subscriber.email: continue # skip empty email address + + # This is a bit wrong if return_users=1 (which implies that the caller will process + # user attributes and may, for example choose to send an SMS) + # So it _should_ be "not (subscriber.email and return_users)" but that breaks at the moment. + if not subscriber.email: continue # skip empty email addresses + if trivial and not subscriber.want_trivial: continue # skip uninterested subscribers if not UserPerms(subscriber).read(self.page_name): continue - if subscriber.isSubscribedTo(pageList): + if subscriber.isSubscribedTo(pageList): lang = subscriber.language or 'en' - if not emails.has_key(lang): emails[lang] = [] + if not subscriber_list.has_key(lang): subscriber_list[lang] = [] if return_users: - emails[lang].append(subscriber) + subscriber_list[lang].append(subscriber) else: - emails[lang].append(subscriber.email) + subscriber_list[lang].append(subscriber.email) - return emails + return subscriber_list def send_page(self, request, msg=None, **keywords): --- user.py.orig 2004-08-30 16:47:42.000000000 +0100 +++ user.py 2004-08-30 10:17:29.000000000 +0100 @@ -110,6 +110,7 @@ ('show_fancy_diff', lambda _: _('Show fancy diffs')), ('wikiname_add_spaces', lambda _: _('Add spaces to displayed wiki names')), ('remember_me', lambda _: _('Remember login information forever')), + ('want_trivial', lambda _: _('Subscribe to trivial changes')), ('disabled', lambda _: _('Disable this account forever')), ] _transient_fields = ['id', 'valid', 'may', 'auth_username', 'trusted'] @@ -173,6 +174,7 @@ self.show_toolbar = 1 self.show_nonexist_qm = config.nonexist_qm self.show_fancy_diff = 1 + self.want_trivial = 0 self.remember_me = 1 if not self.id and not self.auth_username: From rl03 at gentoo.org Mon Aug 30 10:48:17 2004 From: rl03 at gentoo.org (Renat Lumpau) Date: Mon Aug 30 10:48:17 2004 Subject: [Moin-devel] Permissions In-Reply-To: <413304FE.9040908@gmx.de> References: <20040827205033.GA6627@toucan.gentoo.org> <413304FE.9040908@gmx.de> Message-ID: <20040830174733.GA20353@toucan.gentoo.org> On Mon, Aug 30, 2004 at 12:44:14PM +0200, Thomas Waldmann wrote: > >I am cleaning up the Gentoo ebuild for moinmoin, and I have a quick > >question I hope you can help me with. What files does the httpd need > >write access to? Right now I'm doing the equivalent of chown -R > >apache:apache * , and I'd really like something cleaner. > > Additionally to what Florian already said, try to do it without giving > world access to data/ - there are critical informations inside there > like ACL protected pages and user accounts, so they shouldnt be readable > to everybody on FS level. Gentoo uses webapp-config [1][2] to install web applications. Files that the webserver needs write access to are processed by webapp_serverowned(), which installs them with user-specified permissions, and always writeable by the httpd (apache:apache in the most common case). Thus, our users can set permissions on data/ according to their needs. Best, [1] http://dev.gentoo.org/~rl03/webapp-config.html [2] http://dev.gentoo.org/~rl03/webapp.eclass.html -- Renat Lumpau Gentoo developer GPG key id #C6A838DA on http://pgp.mit.edu Key fingerprint = 04AF B5EE 17CB 1000 DDA5 D3FC 1338 ADC2 C6A8 38DA -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: not available URL: