[Zope-dev] Server Side Trojan Issue really dead?

[Steve Alexander]

KevinL wrote:
> 
> > Steve Alexander wrote:
> > However... the zope security system could help with this. Here's an ill
> > thought out idea for your consideration :-)
> >
> > Have a function that takes two sets of permissions, and returns the
> > intersection of these sets. Then, use some sort of local permissions
> > combination to make the wiki page that's been edited have the resultant
> > lowest-common-denominator permissions, even for the owner.
> 
> Correct me if I'm wrong, but wouldn't this have the same problem?  Person of
> high access makes zwiki, person of low access adds evil function to it, person
> of high access views it - unless you're tracking "smallest set of privileges
> held by anyone editing this page" at all times, you're going to intersect
> owner with creator and still allow editor to trojan.

Yes, the idea would be to track the smallest set of privileges held by
anyone editing this page. You take the intersection of the page's
current permissions and the currently-editing user's permissions.

Another simpler solution is to make all the pages unowned, make new
pages unowned, and make them remain unowned even when edited.

However, that may not be a general solution as it is more restrictive
that it may need to be.

--
Steve Alexander
Software Engineer
Cat-Box limited
http://www.cat-box.net