Re: Why is Settings available to Staff?

2010-11-18 Thread Eric Johnson
Hi Christian, Thanks for your swift response! I was able to block access according to my needs, so that was very helpful. I've got more feedback below. This ended up being a long email, in hopes that it would provide lots of useful information for your aims. On 11/17/10 7:15 PM,

Re: Why is Settings available to Staff?

2010-11-18 Thread Christian Hammond
Hi Eric, Thanks for the detailed analysis. This is very helpful for our plans. I'll address the issues inline. On Thu, Nov 18, 2010 at 3:43 PM, Eric Johnson ericjohn...@alumni.brown.edu wrote: *Principle*: Use corporate authentication mechanism. We don't want people to have to remember a

Why is Settings available to Staff?

2010-11-17 Thread Eric Johnson
I'm struggling with a particular configuration problem. I've got three classes of users... Ones that can work on reviews, ones that can do anything (superusers), and ones I want to restrict to being able to muck around with the admin/database models for changesets, diffs, and reviews. The

Re: Why is Settings available to Staff?

2010-11-17 Thread Christian Hammond
Hi Eric, Today, there isn't anything for that. You can work around this by patching reviewboard/admin/views.py to have site_settings check request.user.is_superuser and return some sort of result (redirecting to the login page, or something), and patching templates/admin/base_site.html to add {%