Re: Security Checks in API functions

I came across an interesting concept recently when tasked to set up a DotNetNuke
(DNN) site. In DNN, every view consists of a page, so every access to anything
on the site uses a page as its place-holder.

Each page can have its own set of privileges, so a page may be available to
members only, for example.

Within that page, modules can be added. A module in DNN is similar to a block in
Xaraya. Now, individual privileges can be applied to those 'modules' - so a
member may see additional modules on a page that non-members cannot see.

However, a module can be set to *inherit* its privileges from the page in which
it sits. That is pretty clever, in that a privilege can then be applied to a
whole page, and if the current user cannot see that page then they cannot see
anything that sits in that page. If that page contains articles, for example,
then there is no way around that page to get to the articles through any other
means (unless there is another page that *does* have privileges and links to the
same articles - and even then that other page may contain additional filters on
those articles).

I think it is worth considering the ways in which privileges (and other
features) work in other CMSs, as it helps to see different ways through this
maze. There is always *something* we can nick.

-- Jason