Tuesday 17 April 2007 12:49:16 am
Hello, I need to make it possible for anonymous users to create objects that would become child nodes of a given tree node, but <b>will only be accessible for administrator users</b> in the admin interface. <b>The class</b>, objects of which will be added, <b>contains a file attribute</b>. How secure is it to allow this?
Here's a list of precautions I could think of:
1) I add a privilege for the anonymous role to create function with all the limitations possible, especially telling what class and parent class the creation include, by adding a special section and so on.
2) I define a hard-to-guess object name, based on several fields, including identifier attribute that increments itself automatically. 3) I prepare overrides based on the target class' identifier, which point to some empty or 'you have no business here' templates.
Would that be enough?
Maybe there is a way to verify the file? How secure is this idea generally? Thanks for any suggestions.
--
Company: mediaSELF Sp. z o.o., http://www.mediaself.pl
eZ references: http://ez.no/partners/worldwide_partners/mediaself
eZ certified developer: http://ez.no/certification/verify/272585
eZ blog: http://ez.ryba.eu
|