Bug 39797

Summary:	Permissive instead of restrictive usecase policies
Product:	Lenya	Reporter:	Andreas Hartmann <andreas>
Component:	Access Control	Assignee:	Lenya Developers <dev>
Status:	CLOSED FIXED
Severity:	major
Priority:	P5
Version:	2.0
Target Milestone:	2.0
Hardware:	Other
OS:	other
Attachments:	changes usecase authorization to deny-by-default this patch adds some policies to the default publication changed file location due to andreas' latest commit

Description Andreas Hartmann 2006-06-13 08:24:25 UTC

Doug Chestnut:

Currently usecases get restrictive with policies in usecase-policies.xml. 
Should we make usecase-policies.xml be permissive instead (only allow usecase
execution if a policy exists and the policy is met).  This would force us to
think about policies when creating new functionality.

Comment 1 J 2006-06-23 10:52:50 UTC

Created attachment 18513 [details]
changes usecase authorization to deny-by-default

see the next attachment for some boilerplate policies to make lenya usable
again.

Comment 2 J 2006-06-23 10:57:15 UTC

Created attachment 18514 [details]
this patch adds some policies to the default publication

warning: these policies will only make the site usable for *admins*. a lot more
policies are needed to enable reviewers and editors to do their work again, but
i'm waiting for some feedback first.

Comment 3 J 2006-06-23 10:59:50 UTC

i have raised the priority and severity for this bug, as the patch addresses a
number of security issues.

Comment 4 J 2006-06-23 13:52:46 UTC

Created attachment 18518 [details]
changed file location due to andreas' latest commit

chasing the berzerk patch-man all over svn. i'm only a hair's width behind and
closing in... :-D
(this change is needed to make the patch apply against
http://svn.apache.org/viewvc?rev=416708&view=rev)

Comment 5 Andreas Hartmann 2006-06-23 13:54:25 UTC

I added the functionality to the UsecaseAuthorizerImpl. The correct usecase
policies are not yet set.

Comment 6 J 2006-06-23 13:55:28 UTC

damn. he is too fast for me :-D

Comment 7 Andreas Hartmann 2006-06-23 13:56:42 UTC

BTW, thanks for the patch!
Unfortunately I saw it to late, but the changes are basically the same :)

Comment 8 Andreas Hartmann 2006-06-26 09:03:07 UTC

That's done. If you notice missing or wrong usecase policies, please complain on
dev@lenya.

Comment 9 Thorsten Scherler 2007-07-16 01:59:04 UTC

Renaming Lenya 1.4 to 2.0