John Gaunt wrote: > In an implementation of CanCreateWrapper I am failing to get a codebase > from the subject principal. Everytime I see the failure the subject > principal IS the system principal. Can I infer that if I get no codebase > that I have the system principla (or vice versa)?
At the moment, this is true. I wouldn't rely on it, however, esp not if we move to having some sort of real lattice of principals. > Also, is it safe given one of the two states above to infer that the > call being made is NOT from a web page? Depends on how one defines "web page".... but it _is_ safe to infer that it's not coming from a normal http:// load, yeah. > The issue I am dealing with is knowing when to require a check against > the permissions manager for further clearing. I think you want to use a pointer compare to the system principal and do the check if that pointer compare succeeds. You may also want to check for expanded permissions (UniversalWhateverYouThinkIsRightInYourCase) if the check fails, if those can happen in your app. -Boris _______________________________________________ dev-security mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security
