Re: RFC patch: Deny removal of folder owner ACLs

2011-03-31 Thread Guilherme Maciel Ferreira
Hi Bron, On Wednesday 30 March 2011 10:05:27 Bron Gondwana wrote: > I'd like to put this into 2.4.7 - but I'm still confused by a few things! > > 1) ACL_MODE_ADD - it's now not being checked for any more, only > ACL_MODE_SET and ACL_MODE_REMOVE. I guess the theory is that ADD can > never remove

Re: RFC patch: Deny removal of folder owner ACLs

2011-03-30 Thread Bron Gondwana
On Wed, 30 Mar 2011 10:10:14 +0200 Bron Gondwana wrote: > Oh ok - that was only pushed to master, not to 2.4 stable. I will just add > the new patch > to -stable for 2.4.7. Changed my mind again sorry - that code is complex and brittle and liable to break if I try to code this against it. Go

Re: RFC patch: Deny removal of folder owner ACLs

2011-03-30 Thread Bron Gondwana
On Thu, 17 Mar 2011 14:19:31 +0100 Guilherme Maciel Ferreira wrote: > Hi, > > We found a bug in the cyrus-imapd-2.4.6-keep-owner-rights patch. That occur > in > the SETACL command, when trying to remove the admin rights. Thus, the > following command should work, but does not: > SETACL ma

Re: RFC patch: Deny removal of folder owner ACLs

2011-03-30 Thread Bron Gondwana
On Thu, 17 Mar 2011 14:19:31 +0100 Guilherme Maciel Ferreira wrote: > Hi, > > We found a bug in the cyrus-imapd-2.4.6-keep-owner-rights patch. That occur > in > the SETACL command, when trying to remove the admin rights. Thus, the > following command should work, but does not: > SETACL ma

Re: RFC patch: Deny removal of folder owner ACLs

2011-03-29 Thread Guilherme Maciel Ferreira
Hi, We found a bug in the cyrus-imapd-2.4.6-keep-owner-rights patch. That occur in the SETACL command, when trying to remove the admin rights. Thus, the following command should work, but does not: SETACL mailbox mailboxowner -xi And this one should not work, but actually works: SETACL

Re: RFC patch: Deny removal of folder owner ACLs

2011-03-17 Thread Guilherme Maciel Ferreira
Hi, We found a bug in the cyrus-imapd-2.4.6-keep-owner-rights patch. That occur in the SETACL command, when trying to remove the admin rights. Thus, the following command should work, but does not: SETACL mailbox mailboxowner -xi And this one should not work, but actually works: SETACL

Re: RFC patch: Deny removal of folder owner ACLs

2011-02-04 Thread Jeroen van Meeuwen (Kolab Systems)
Guilherme Maciel Ferreira wrote: > Hi, > > here is the patch against the master. > Applied and pushed, with full attribution, thanks! Kind regards, Jeroen van Meeuwen -- Senior Engineer, Kolab Systems AG e: vanmeeu...@kolabsys.com t: +316 42 801 403 w: http://www.kolabsys.com pgp: 9342 BF0

Re: RFC patch: Deny removal of folder owner ACLs

2011-01-27 Thread Guilherme Maciel Ferreira
Hi, here is the patch against the master. Best regards, On Friday 21 January 2011 03:14:57 Jeroen van Meeuwen (Kolab Systems) wrote: > Bron Gondwana wrote: > > I like the idea - and it would be great if you did a patch again git > > master at http://git.cyrusimap.org/ - follow the links. Or if

Re: RFC patch: Deny removal of folder owner ACLs

2011-01-24 Thread Guilherme Maciel Ferreira
Hi Bron, thanks for the reply. On Thursday 20 January 2011 12:08:53 Bron Gondwana wrote: > On Thu, Dec 30, 2010 at 10:45:18AM +0100, Guilherme Maciel Ferreira wrote: > > So we changed the imap server to avoid such kind of behavior. The patch > > was developed for version 2.3.16. It is possible to

Re: RFC patch: Deny removal of folder owner ACLs

2011-01-20 Thread Jeroen van Meeuwen (Kolab Systems)
Bron Gondwana wrote: > I like the idea - and it would be great if you did a patch again git > master at http://git.cyrusimap.org/ - follow the links. Or if you use > git you can just fork it and ask us to pull your branch! That way you > get full credit :) > Send us a patch via email and you ge

Re: RFC patch: Deny removal of folder owner ACLs

2011-01-20 Thread Bron Gondwana
On Thu, Dec 30, 2010 at 10:45:18AM +0100, Guilherme Maciel Ferreira wrote: Gosh - sorry nobody responded to this! > We were having problems with some users who deleted all ACL rights > from a folder, rendering the mailbox inaccessible. > > There's already a feature in cyrus that the folder owne

RFC patch: Deny removal of folder owner ACLs

2010-12-30 Thread Guilherme Maciel Ferreira
Hi, We were having problems with some users who deleted all ACL rights from a folder, rendering the mailbox inaccessible. There's already a feature in cyrus that the folder owner can't delete his own administration rights (implicit acls). This left one hole in the protection which is still cumb