mailu

You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

History

Pierre Jaury 4e4f2b8037 First shot at improving access control, related to #42 A couple of things are important to note for this commit: - it only implements the new access control for alias and admin management - the access control code is located in access.py The idea behind simpler access control is auditability. There have been a couple of bugs related to functions not checking permissions properly. If checking permissions is as simple as decorating a function, exporting the permission scheme for an audit should be simple. Also, this still does not address the information leakage related to 404 errors when an object does not exist, independently of permissions the user has over the domain.	8 years ago
..
admin	First shot at improving access control, related to #42	8 years ago
__init__.py	Have the admin interface listen on localhost	8 years ago

Pierre Jaury 4e4f2b8037 First shot at improving access control, related to #42

A couple of things are important to note for this commit:
- it only implements the new access control for alias and admin management
- the access control code is located in access.py

The idea behind simpler access control is auditability. There have been a
couple of bugs related to functions not checking permissions properly. If
checking permissions is as simple as decorating a function, exporting the
permission scheme for an audit should be simple.

Also, this still does not address the information leakage related to 404 errors
when an object does not exist, independently of permissions the user has over
the domain.

admin

First shot at improving access control, related to #42

__init__.py

Have the admin interface listen on localhost