How safe is "view management screens"?
Since one of my sites doesn't use any password-protected database connection, or anything else that I can't let my users see, and since the site is primarily directed at the Free Software community, I'm considering a way of allowing users to view all my source code. Just adding a ``view source'' method may not cut it, because cross-method calls would obscure a lot of the thing. I was thinking that perhaps the most easy and powerful way would be giving ``View management screens'' to Anonymous. Assuming I don't give them any add/change/delete permissions, that should be safe enought, no? Or am I missing something? (If I can do that, it would be also very cool because I'd be showing off what Zope can do. Of course I'd have to make the Products I use available for download somewhere else, but that's a given anyway.) []s, |alo +---- -- I am Lalo of deB-org. You will be freed. Resistance is futile. http://www.webcom.com/lalo mailto:lalo@webcom.com pgp key in the web page Debian GNU/Linux --- http://www.debian.org Brazil of Darkness -- http://zope.gf.com.br/BroDar
Lalo Martins wrote:
Since one of my sites doesn't use any password-protected database connection, or anything else that I can't let my users see, and since the site is primarily directed at the Free Software community, I'm considering a way of allowing users to view all my source code.
Just adding a ``view source'' method may not cut it, because cross-method calls would obscure a lot of the thing.
I was thinking that perhaps the most easy and powerful way would be giving ``View management screens'' to Anonymous. Assuming I don't give them any add/change/delete permissions, that should be safe enought, no? Or am I missing something?
No, it SHOULD be safe. Note that no one has done a full security audit of Zope. But, for the purposes of delegating managment, the ability to 'view' a managment screen and the ability to change something are allways different permissions. For example, members of zope.org can view the managment interface, but not necesarily do anything we don't want them to. -Michel
participants (2)
-
Lalo Martins -
Michel Pelletier