|
Monday 27 January 2003 4:02:54 pm
1. I tested with register_globals off and all worked fine. This is a remarkable security improvement in ezp3. Thanks a lot. 2. I took some time to become familiar with the new object model. No doubt, the redundancies of ezp2 have been eroded with great rigor. This is appealing. However, I think in one case the goal to achieve an object model as compact as possible has been driven a step too far: In the treatment of users and user groups as instances of "CONTENT". User accounts and user groups, having "draft" and "publishing" state buttons assigned to them on the admin console, are a funny thing in first stance, but irritating and annoying in the long run. I recommend to review this. I further think there should be no direct assignment of roles to individual user accounts. Instead I suggest to replace the still too UNIX-like concept of a "User Group" with an object pattern "User Profile". Instances of "User Profile" should then become the only entities carrying role assignments. And there should be a n:1-relation between users and such profiles. So we get back what we can do with a "user group", just by assigning the same pattern of roles (now as a permission profile) to a multitude of users. And what else should we need "groups" for, if not to attach or detach individual user accounts to (from) permission patterns ? 3. The new template engine is a powerful, but also a heavyweight tool. For people like me - familiar with the template rendering model of ezp2 - it's a major paradigm shift to swallow. Oops. For people familiar with putting tiny php-snippets into HTML-pages it looks like "yet another proprietary scripting language on top of php." Most of all i hope it becomes no serious obstacle for future approaches to strengthen the role of XSLT in rendering. Concerns like this have already been reported in this forum and I do share them. However, the template engine is a tool with thorough and intelligent design. It's much faster than the former template utility and suitably stable yet, as far as I see. So it's hard for me to find out whether I love it or not. 4. I still don't know how to customize policies in the admin console. Summary: I like ezp3 and will move my new site to this crazy tool. See the outcome within the next 10 days, if I have not fallen into dispair with templates by then ;-) Regards to you all out there. Volker
|