Redmine

This patch adds "Export issues" and "Export time entries" permissions for consistency with the existing "Export wiki pages" permission, allowing administrators to restrict CSV, PDF, and other exports by role.

Redmine has three modules with export functions, but only the wiki module has a separate permission for exports ("Export wiki pages", added in r3371). Any user who can view issues can export them as CSV or PDF, and any user who can view time entries can export them as CSV. This includes the Anonymous role on public projects, and administrators have no way to limit it.

The attached patch adds two permissions, following the same pattern as "Export wiki pages":

For a list that spans several projects (global lists, or a project with subprojects), the permission is required on every project containing records being exported. Otherwise, records from projects without the permission would have to be silently omitted, making the export differ from the HTML list. The check is a single query based on Project.allowed_to_condition and is skipped for administrators and for single projects without subprojects.

Not affected: Atom feeds (a subscription mechanism with its own key, cheap to generate), the REST API (as with "Export wiki pages"), the version changelog TXT (cheap, not an issue list export), and the CSV exports outside project modules (users, roles, members, projects).

To keep the current behavior, the migration adds "Export issues" to every role that has "View issues" and "Export time entries" to every role that has "View spent time", including the Anonymous and Non member roles. On new installations, the default data loader grants both permissions to all default roles except Anonymous, so that crawlers cannot overload the server by mass-requesting the export URLs of public projects.

This also resolves #3661, which has asked since 2009 for a way to prevent crawlers from triggering PDF generation. #31617 added Disallow entries to robots.txt, but these only affect well-behaved crawlers. With this change, administrators can prevent anonymous PDF generation simply by removing "Export issues" from the Anonymous role, as suggested in #3661#note-2 and #3661#note-6.