[
https://issues.apache.org/jira/browse/SLING-5135?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15586647#comment-15586647
]
Robert Munteanu commented on SLING-5135:
----------------------------------------
I think it would be useful to have a configuration option which instead of
replacing the default bundle list adds to it.
My reasoning is that when configuring the whitelist on a custom setup you need
to
# look at the code (and you need to know where the default whitelisted bundles
are defined)
# transform the default bundle list into the provisioning model format
# append the new bundle to the config
# create a new config for the
{{org.apache.sling.jcr.base.internal.LoginAdminWhitelistImpl}} component
With the 'append' property exposed a user can only do steps 3 and 4, which is a
definite improvement. I fear that if it's too complicated users will simply
re-enable login administrative or use an unsafe regular expression.
> Whitelist legit usages of loginAdministrative and administrative
> ResourceResolver
> ---------------------------------------------------------------------------------
>
> Key: SLING-5135
> URL: https://issues.apache.org/jira/browse/SLING-5135
> Project: Sling
> Issue Type: Bug
> Components: JCR
> Reporter: Antonio Sanso
> Assignee: Bertrand Delacretaz
> Attachments: SLING-5135.patch, SLING-5135.patch
>
>
> {{AbstractSlingRepositoryManager}} contains a method that disable
> loginAdministrative support
> {code}
> /**
> * Returns whether to disable the
> * {@code SlingRepository.loginAdministrative} method or not.
> *
> * @return {@code true} if {@code SlingRepository.loginAdministrative} is
> * disabled.
> */
> public final boolean isDisableLoginAdministrative()
> {code}
> This is a global configuration. It would be nice to have an extension of such
> mechanism that contains a white list of (few) legit usage of
> {{loginAdministrative}}
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
