Re: createPartyRole permission for anonymous user

[David E. Jones]

-David


On Mar 26, 2007, at 2:53 PM, Anil Patel wrote:

I'd say that's a really big NO. We don't want the anonymous user to ever have any permissions. Anyone with a browser and an internet connection can create a Party that will be used by the anonymous user. With the anonymous UserLogin the partyId is set in memory and passed around, but NEVER saved to the database. This is used to get around the security constraints on most services in order for things to function. Where are you running into a problem with this? Ie, what is the specific circumstance?

Hi, Today we started getting following error while creating user in
Anonymous checkout process.

  - Security Error: to run createPartyRole you must have the

  in createUpdateUser


these services to be protected with permission check? The createPerson
service is not.

Please comment so I needed I'll submit patch for this.

Regards
Anil

PARTYMGR_CREATE or PARTYMGR_ADMIN permission calling service createPartyRole I think we need to add some permissions to Anonymous user. Do we even need

smime.p7s
Description: S/MIME cryptographic signature