Re: [security] new use case for a checkPermission API

Fri, 07 Aug 2020 00:14:27 -0700 

Assuming we are good to go, should I use an internal API for now in pipes, and 
we discuss around moving it to a bundle later?

Nicolas

On 06/08/2020 16:48, "Bertrand Delacretaz" <[email protected]> wrote:

    Hi,

    On Thu, Aug 6, 2020 at 4:00 PM Nicolas Peltier <[email protected]> wrote:
    > ...we have
    > if i count correctly at least 2 legit usages of this (clam & pipes), which
    > is enough for legitimizing an API, right?...

    I think so, and there's been several cases already where permissions
    on arbitrary-named operations (like "execute Sling Pipes via HTTP" in
    your case) can help.

    -Bertrand

    > [0] 
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fissues.apache.org%2Fjira%2Fbrowse%2FSLING-9556&amp;data=02%7C01%7Cnpeltier%40adobe.com%7Cc143de6b45d0412dcc4008d83a17d753%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C637323221356938169&amp;sdata=E2lDv0O8Eu6kttRvm2JzIwuLgFsOTcqnlqmRQL7zQsE%3D&amp;reserved=0
    > [1]
    > 
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.apache.org%2Fthread.html%2Fe949e6328729e493ec0028642173228933ebf6d9b322da5aa0dd64d3%2540%253Cdev.sling.apache.org%253E&amp;data=02%7C01%7Cnpeltier%40adobe.com%7Cc143de6b45d0412dcc4008d83a17d753%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C637323221356938169&amp;sdata=TvhmI0anfsb%2FmaN8EInCNHDNLDgWLHdCAuiDgGQnSEE%3D&amp;reserved=0
    > [2]
    > 
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.apache.org%2Fthread.html%2F72475f31d9dda5128528d67f491468b081c958e9c3b93924de633c3e%2540%253Cdev.sling.apache.org%253E&amp;data=02%7C01%7Cnpeltier%40adobe.com%7Cc143de6b45d0412dcc4008d83a17d753%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C637323221356938169&amp;sdata=ly%2B6r%2Bry60bxEZRcoX2VLJWqnuVRDm5Zjha6yUKcTbM%3D&amp;reserved=0

Reply via email to