You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@lenya.apache.org by Josias Thöny <jo...@wyona.com> on 2006/06/21 15:00:25 UTC
[1.4] protect admin usecases
Hi,
Currently most admin usecases can be executed by a normal (non-admin)
user, because it's possible to call admin usecases in the authoring
area.
You just have to enter:
http://localhost:8888/default/authoring/index.html?lenya.usecase=admin.users
And you can e.g. delete other users :)
Probably we should protect all admin usecases in usecase-policies.xml in
the default publication.
Or should admin usecases only be allowed in the admin area?
WDYT?
Josias
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org
Re: [1.4] protect admin usecases
Posted by Andreas Hartmann <an...@apache.org>.
Josias Thöny wrote:
> Hi,
>
> Currently most admin usecases can be executed by a normal (non-admin)
> user, because it's possible to call admin usecases in the authoring
> area.
>
> You just have to enter:
> http://localhost:8888/default/authoring/index.html?lenya.usecase=admin.users
>
> And you can e.g. delete other users :)
>
> Probably we should protect all admin usecases in usecase-policies.xml in
> the default publication.
Yes, this is already on the TODO list:
http://issues.apache.org/bugzilla/show_bug.cgi?id=39797
-- Andreas
--
Andreas Hartmann
Wyona Inc. - Open Source Content Management - Apache Lenya
http://www.wyona.com http://lenya.apache.org
andreas.hartmann@wyona.com andreas@apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org
Re: [1.4] protect admin usecases
Posted by Andreas Hartmann <an...@apache.org>.
Jann Forrer wrote:
[...]
>>>>> Yes, it looks like we don't need it anymore. Maybe it wasn't very
>>>>> appropriate anyway to have an area for the admin
>>>>> usecases, because an area in Lenya is rather something which contains
>>>>> documents, IMHO.
>>>> Yes, I share this point of view.
>>>
>>> Not sure though.
>>>
>>> Where should the user management then go?
>>>
>>> IMO having an admin area makes sense, how would we then offer this
>>> usecases?
> >
>
> +1 Having a seperate (GUI) admin area is certainly useful.
>
>>
>> From the user's point of view nothing would change but the URL.
>>
> Do not fully understand..... Would that mean to keep the admin area in
> the GUI?
The "admin area" in the sense of an administration GUI would not
be changed. But it would be accessed for instance via
/<pub>/authoring/foobar.html?lenya.usease=admin.users
This already works, I think the only purpose of the /<pub>/admin
URLs is to redirect to the corresponding usecase. We would have
to change the tab to call the default admin usecase directly.
-- Andreas
--
Andreas Hartmann
Wyona Inc. - Open Source Content Management - Apache Lenya
http://www.wyona.com http://lenya.apache.org
andreas.hartmann@wyona.com andreas@apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org
Re: [1.4] protect admin usecases
Posted by Jann Forrer <ja...@id.unizh.ch>.
Andreas Hartmann wrote:
> Thorsten Scherler wrote:
>> El mié, 21-06-2006 a las 16:30 +0200, Andreas Hartmann escribió:
>>> Josias Thöny wrote:
>>>> On Wed, 2006-06-21 at 15:07 +0200, Andreas Hartmann wrote:
>>>>> Josias Thöny wrote:
>>>>>> Hi,
>>>>>>
>>>>>> Currently most admin usecases can be executed by a normal (non-admin)
>>>>>> user, because it's possible to call admin usecases in the authoring
>>>>>> area.
>>>>> BTW, do we still need the admin area?
>>>>> IMO it's just a collection of usecases like the site area, and
>>>>> access control is based on usecases anyway with the current
>>>>> architecture.
>>>>>
>>>>> WDYT?
>>>> Yes, it looks like we don't need it anymore. Maybe it wasn't very
>>>> appropriate anyway to have an area for the admin
>>>> usecases, because an area in Lenya is rather something which contains
>>>> documents, IMHO.
>>> Yes, I share this point of view.
>>
>> Not sure though.
>>
>> Where should the user management then go?
>>
>> IMO having an admin area makes sense, how would we then offer this
>> usecases?
>
+1 Having a seperate (GUI) admin area is certainly useful.
>
> From the user's point of view nothing would change but the URL.
>
Do not fully understand..... Would that mean to keep the admin area in
the GUI?
Jann
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org
Re: [1.4] protect admin usecases
Posted by Andreas Hartmann <an...@apache.org>.
Thorsten Scherler wrote:
> El mié, 21-06-2006 a las 16:30 +0200, Andreas Hartmann escribió:
>> Josias Thöny wrote:
>>> On Wed, 2006-06-21 at 15:07 +0200, Andreas Hartmann wrote:
>>>> Josias Thöny wrote:
>>>>> Hi,
>>>>>
>>>>> Currently most admin usecases can be executed by a normal (non-admin)
>>>>> user, because it's possible to call admin usecases in the authoring
>>>>> area.
>>>> BTW, do we still need the admin area?
>>>> IMO it's just a collection of usecases like the site area, and
>>>> access control is based on usecases anyway with the current
>>>> architecture.
>>>>
>>>> WDYT?
>>> Yes, it looks like we don't need it anymore.
>>> Maybe it wasn't very appropriate anyway to have an area for the admin
>>> usecases, because an area in Lenya is rather something which contains
>>> documents, IMHO.
>> Yes, I share this point of view.
>
> Not sure though.
>
> Where should the user management then go?
>
> IMO having an admin area makes sense, how would we then offer this
> usecases?
From the user's point of view nothing would change but the URL.
-- Andreas
--
Andreas Hartmann
Wyona Inc. - Open Source Content Management - Apache Lenya
http://www.wyona.com http://lenya.apache.org
andreas.hartmann@wyona.com andreas@apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org
Re: [1.4] protect admin usecases
Posted by Thorsten Scherler <th...@wyona.com>.
El mié, 21-06-2006 a las 16:30 +0200, Andreas Hartmann escribió:
> Josias Thöny wrote:
> > On Wed, 2006-06-21 at 15:07 +0200, Andreas Hartmann wrote:
> >> Josias Thöny wrote:
> >>> Hi,
> >>>
> >>> Currently most admin usecases can be executed by a normal (non-admin)
> >>> user, because it's possible to call admin usecases in the authoring
> >>> area.
> >> BTW, do we still need the admin area?
> >> IMO it's just a collection of usecases like the site area, and
> >> access control is based on usecases anyway with the current
> >> architecture.
> >>
> >> WDYT?
> >
> > Yes, it looks like we don't need it anymore.
> > Maybe it wasn't very appropriate anyway to have an area for the admin
> > usecases, because an area in Lenya is rather something which contains
> > documents, IMHO.
>
> Yes, I share this point of view.
Not sure though.
Where should the user management then go?
IMO having an admin area makes sense, how would we then offer this
usecases?
salu2
--
Thorsten Scherler
COO Spain
Wyona Inc. - Open Source Content Management - Apache Lenya
http://www.wyona.com http://lenya.apache.org
thorsten.scherler@wyona.com thorsten@apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org
Re: [1.4] protect admin usecases
Posted by Andreas Hartmann <an...@apache.org>.
Josias Thöny wrote:
> On Wed, 2006-06-21 at 15:07 +0200, Andreas Hartmann wrote:
>> Josias Thöny wrote:
>>> Hi,
>>>
>>> Currently most admin usecases can be executed by a normal (non-admin)
>>> user, because it's possible to call admin usecases in the authoring
>>> area.
>> BTW, do we still need the admin area?
>> IMO it's just a collection of usecases like the site area, and
>> access control is based on usecases anyway with the current
>> architecture.
>>
>> WDYT?
>
> Yes, it looks like we don't need it anymore.
> Maybe it wasn't very appropriate anyway to have an area for the admin
> usecases, because an area in Lenya is rather something which contains
> documents, IMHO.
Yes, I share this point of view.
-- Andreas
--
Andreas Hartmann
Wyona Inc. - Open Source Content Management - Apache Lenya
http://www.wyona.com http://lenya.apache.org
andreas.hartmann@wyona.com andreas@apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org
Re: [1.4] protect admin usecases
Posted by Josias Thöny <jo...@wyona.com>.
On Wed, 2006-06-21 at 15:07 +0200, Andreas Hartmann wrote:
> Josias Thöny wrote:
> > Hi,
> >
> > Currently most admin usecases can be executed by a normal (non-admin)
> > user, because it's possible to call admin usecases in the authoring
> > area.
>
> BTW, do we still need the admin area?
> IMO it's just a collection of usecases like the site area, and
> access control is based on usecases anyway with the current
> architecture.
>
> WDYT?
Yes, it looks like we don't need it anymore.
Maybe it wasn't very appropriate anyway to have an area for the admin
usecases, because an area in Lenya is rather something which contains
documents, IMHO.
Josias
>
> -- Andreas
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org
Re: [1.4] protect admin usecases
Posted by Jörn Nettingsmeier <po...@uni-duisburg.de>.
Andreas Hartmann wrote:
> Josias Thöny wrote:
>> Hi,
>>
>> Currently most admin usecases can be executed by a normal (non-admin)
>> user, because it's possible to call admin usecases in the authoring
>> area.
>
> BTW, do we still need the admin area?
> IMO it's just a collection of usecases like the site area, and
> access control is based on usecases anyway with the current
> architecture.
i'd vote to get rid of it. the entire area concept is debatable anyway
imho (i'm with solprovider on this issue), and the less stuff is
attached to it, the better.
we may need to rethink the generation of the menus, though. usecases
that are of no use to users should not be visible, and currently much of
this hiding is done by the admin area...
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org
Re: [1.4] protect admin usecases
Posted by Andreas Hartmann <an...@apache.org>.
Josias Thöny wrote:
> Hi,
>
> Currently most admin usecases can be executed by a normal (non-admin)
> user, because it's possible to call admin usecases in the authoring
> area.
BTW, do we still need the admin area?
IMO it's just a collection of usecases like the site area, and
access control is based on usecases anyway with the current
architecture.
WDYT?
-- Andreas
--
Andreas Hartmann
Wyona Inc. - Open Source Content Management - Apache Lenya
http://www.wyona.com http://lenya.apache.org
andreas.hartmann@wyona.com andreas@apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org
Re: [1.4] protect admin usecases
Posted by Jörn Nettingsmeier <po...@uni-duisburg.de>.
Andreas Hartmann wrote:
> Jörn Nettingsmeier wrote:
>> Josias Thöny wrote:
>>> Hi,
>>>
>>> Currently most admin usecases can be executed by a normal (non-admin)
>>> user, because it's possible to call admin usecases in the authoring
>>> area.
>>>
>>> You just have to enter:
>>> http://localhost:8888/default/authoring/index.html?lenya.usecase=admin.users
>>>
>>>
>>> And you can e.g. delete other users :)
>>>
>>> Probably we should protect all admin usecases in usecase-policies.xml in
>>> the default publication.
>>> Or should admin usecases only be allowed in the admin area?
>>
>> let's move to prohibit-by-default for usecases now. i have hacked up
>> some code to do that, and it looks pretty simple. would be a sure way to
>> harden the trunk prior to release, and you can't miss anything that way
>> because anything you miss will get broken...
>
> Would you mind attaching the patch to the bug report?
done.
--
"Open source takes the bullshit out of software."
- Charles Ferguson on TechnologyReview.com
--
Jörn Nettingsmeier, EDV-Administrator
Institut für Politikwissenschaft
Universität Duisburg-Essen, Standort Duisburg
Mail: pol-admin@uni-due.de, Telefon: 0203/379-2736
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org
Re: [1.4] protect admin usecases
Posted by Andreas Hartmann <an...@apache.org>.
Jörn Nettingsmeier wrote:
> Josias Thöny wrote:
>> Hi,
>>
>> Currently most admin usecases can be executed by a normal (non-admin)
>> user, because it's possible to call admin usecases in the authoring
>> area.
>>
>> You just have to enter:
>> http://localhost:8888/default/authoring/index.html?lenya.usecase=admin.users
>>
>> And you can e.g. delete other users :)
>>
>> Probably we should protect all admin usecases in usecase-policies.xml in
>> the default publication.
>> Or should admin usecases only be allowed in the admin area?
>
> let's move to prohibit-by-default for usecases now. i have hacked up
> some code to do that, and it looks pretty simple. would be a sure way to
> harden the trunk prior to release, and you can't miss anything that way
> because anything you miss will get broken...
Would you mind attaching the patch to the bug report?
Thanks!
-- Andreas
--
Andreas Hartmann
Wyona Inc. - Open Source Content Management - Apache Lenya
http://www.wyona.com http://lenya.apache.org
andreas.hartmann@wyona.com andreas@apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org
Re: [1.4] protect admin usecases
Posted by Jörn Nettingsmeier <po...@uni-duisburg.de>.
Josias Thöny wrote:
> Hi,
>
> Currently most admin usecases can be executed by a normal (non-admin)
> user, because it's possible to call admin usecases in the authoring
> area.
>
> You just have to enter:
> http://localhost:8888/default/authoring/index.html?lenya.usecase=admin.users
>
> And you can e.g. delete other users :)
>
> Probably we should protect all admin usecases in usecase-policies.xml in
> the default publication.
> Or should admin usecases only be allowed in the admin area?
let's move to prohibit-by-default for usecases now. i have hacked up
some code to do that, and it looks pretty simple. would be a sure way to
harden the trunk prior to release, and you can't miss anything that way
because anything you miss will get broken...
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org