snoopdave opened a new pull request, #164:
URL: https://github.com/apache/roller/pull/164
The Blogger and MetaWeblog XML-RPC handlers are Roller's legacy
remote-publishing
API. This change makes them apply the same per-weblog and per-entry
permission
model that the rest of Roller uses, so a caller is authorized against the
weblog
or entry an operation actually touches.
## What changed
- Apply an explicit per-method permission matrix (weblog `ADMIN` /
`EDIT_DRAFT` /
`POST`, or entry-level write permission) to the weblog or entry actually
touched.
- `getUserInfo` returns only the authenticated user; `getUsersBlogs` returns
only
API-enabled member weblogs.
- Entry-ID operations authorize against the entry's own weblog.
- Foreign and unknown identifiers produce the same fault.
- Bound the number of entries a recent-posts call scans for a limited member.
## Tests
Table-driven integration suite over every exposed handler method: authorized
member, authenticated non-member, insufficient role, disabled
user/weblog/API,
draft-to-published transition, filtered recent posts, category/weblog
mismatch,
and foreign/absent resource identifiers.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
