Fossil Forum
Post: Is there a permission (or tactic?) for this?
I had hoped, with the granularity of permissions that Fossil features, that it would be possible to set up a repo so that "anonymous" gets no access at all, but that "nobody" could "read"/see specific files. Reading through the permissions codes, that looks like o.
My scenario: I want PHP to be able to access the "raw" version of certain files—I use CSV and INI files for some sorts of data, and then manipulate these with PHP for display. And "nobody" with o makes this possible. It seems, however, that o allows rather more than this. From the "hamburger", a human "nobody" can see/browse all aspects of files (file browser, timeline, branches). And on reflection, that makes sense for the o permission.
What I had hoped to set up was a completely "locked down" interface, except for access to specific URLs, of the type (e.g.):
https://example.com:8080/myrepo/raw?filename=path/to/filel&ci=trunk&m=text/plain
and no random "browsing" allowed.
My hunch now is that this is optimistic, but thought I'd ask here in case I've missed anything (which is likely). Perhaps something in the setup of the web interface? Z
Why not just make the specific files available via your static web server (noting that fossil can act as same if you really want/need to)?
You would have to, if doing so, serve an actual file from disk and not from the repo archive itself, but if it's a small number of files it is what I would do.
Easy enough to do some scripting to freshen them from the repo if you are pushing the changes remotely too.
It's also possible to whitelist specific URLs (I think) for anyone without permissions otherwise.
There is a "Public Pages" setting under Setup→Access that accepts a comma-separate list of GLOB patterns. Any document matching one of those patterns is accessible as if the user has the permissions of "Default privileges". The "Default privileges" setting is further down on the same page.
Thanks - that all looks possible and if there was no other way, I guess that is what I would need to do ... although I'm not creative or knowledgeable enough to know how to use...
some scripting to freshen them from the repo
...if I can't work out how to make them accessible to a script to start with. I'm sure I'm missing something! But drh's information gives a way forward, I think.
Thanks! This was what I was missing. I followed the instructions in the Access page, and have now set up my /docs directory as "public". That achieves exactly what I was after. Yet again, Fossil "FTW"! :)
No problem - glad you got it working!