Concept Security and ACLs

Your Rating:

Thanks for voting!

Please Wait

Results:

143

rates

We have several security related issues or things we should improve:

ACLs dialog

• show all permissions (no drop down) to give an overview
• aggregated permissions per user are already visible as of Magnolia 4.5 see MAGNOLIA-3938@jira for details

Delete permission: MAGNOLIA-2674@jira

• what permission do you need

RegEx support

• even if the back-end uses regular expressions one can only provide partial regular expressions (for instance /$)

Nodetype support

• one of the most annoying thing is that the current ACLs cannot distinguish between paragraphs and sub pages
• one would like to give edit permission to a page but not to the subpages

Custom AccessManager

• see: MAGNOLIA-2587@jira

Clean ACL resolution

• a clean concept is needed how the actual permission is determined
• ACL entries overloading (if multiple ACLs apply, multiple roles)

Easy site support

• give edit permission to a single site
• currently one has to fall back on the ugly /$ hack

URISecurityFilter

• needs to be refactored and broken down in subchain (or set of voters) for operations all handled inside of original filter currently
  • http method check
  • IP check
  • URI ACL check