elecharny commented on PR #382: URL: https://github.com/apache/directory-server/pull/382#issuecomment-6405112177
The raised issue is really critical: we must absolutely check the authorization for each entry potentially returned to the client. Now, I'm not sure the proposed solution is ideal: it costs a supplemental search for each modified entry, something we want to avoid at all. Ideally speaking, we should go through the interceptor chains up to the Authorization interceptor, but no farther. It would require the addition of a flag in the Operation context that would tell the Authz interceptor to just verify the resuqested authorization. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
