https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26129
David Cook <[email protected]> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Failed QA --- Comment #58 from David Cook <[email protected]> --- I decided to stay late and do a quick look... and overall it seems pretty straightforward since it's just the skeleton and none of the muscle/meat. I was getting excited to mark it with my SO and mark Passed QA. But there's 1 problem and that's permissions. I can't sign off on this at the moment, because the API permissions are 'parameters: "*"' and there is no further authorization beyond that. -- So let me propose something... what about a "permissions" column? When creating a row in "configurations" you must specify the permission required for that configuration. When you're fetching, updating, or deleting that row, the API user has to have that permission. In this way, "configurations" can be dynamic yet still strongly protected. -- It does present some difficulties with Koha Plugins, but... that's already a separate issue, and this change would be extensible enough to accommodate future permissions added, so I think it would be OK. -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
