I'm thinking it would be useful to change the semantics of SLAPI ACL plugins in 2.3 to allow access to proceed on the union result of SLAPI plugins and internal ACL evaluation (including overlays).
In 2.3 presently and 2.2, only intersection semantics are supported (ie. all SLAPI ACL plugins as well as internal ACLs must grant access for access to be granted). However, this would be a significant change from 2.2 (note that there is no standard to follow for SLAPI ACL plugins) so I'm curious to know whether anyone else is dependent on this behaviour. I'm very wary of changing such a sensitive code path. -- Luke --
