Yah, I know I could use pageValidate for everything, but that's sort
of bodgy because it's really meant to validate, well, pages, not resources.
So if both users and administrators can see the "change Password" page, it's
awkward to recode it as "users can see the change Password page if and only
if the target resource is *their own* user record, while administrators can
always see if".
Fortunately all my pages use the same resource descriptor so I can
pass that from the validator to my resource manager and determine security
authorization that way, so it will work.
I was hoping to avoid going down that road though because it
basically required I replicate the same logical information twice. I first
secure resources in the gui so that you only see links to things you're
allowed to see. I then secure resources in the resource manager so there's a
duplication of labour I'd like to avoid, hence my flirtation with the URL
signing concept.
--- Pat
> -----Original Message-----
> From: Chris Chiappone [mailto:[EMAIL PROTECTED]
> Sent: Thursday, November 10, 2005 7:06 AM
> To: Tapestry users
> Subject: Re: Controlling Access to Resources
>
> Tap 4 can be done the same with pageValidate.
>
> On 11/10/05, Damian Krzeminski <[EMAIL PROTECTED]> wrote:
> > Patrick Casey wrote:
> > >
> > >
> > > <snip>
> > > Now, in theory, I'm vulnerable to a malicious user who
> could
> > > gain a user account and then submit synthetic directlinks referencing
> admin
> > > type resources. Just because my gui didn't render him a link to the
> > > administrator's user record doesn't mean that he can't type one in;
> it's
> > > just a string of letters and numbers. I can't do security based on
> link
> > > structure because, as I mentioned, both users and admins often have
> exactly
> > > the same physical link structure, rather I have to do it based on
> content.
> > >
> >
> > In Tapestry 3.0 (not sure about 4.x) pageValidate is called by
> DirectService (which is used to
> > implement DirectLinks), so if you have authorization code there, your
> direct links might be made
> > inaccessible to less privileged users. If you have "border-like"
> component that is used by all your
> > pages you use its pageValidate to implement simple role based
> authentication.
> > Damian
> >
> >
> > >
> > >
> > > <snip>
> > >
> > > --- Pat
> > >
> > >
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: [EMAIL PROTECTED]
> > For additional commands, e-mail: [EMAIL PROTECTED]
> >
> >
>
>
> --
> ~chris
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [EMAIL PROTECTED]
> For additional commands, e-mail: [EMAIL PROTECTED]
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
