Re: Security Checks in API functions

[email protected] wrote:
> Do we really need them?
> 
> Xaraya makes heavy use of security checks, and since they result in 
> performance hits we need ot try and reduce them where redundant or 
> unnecessary.
> 
> API functions are always called by something else, so the idea presents 
> itself: why not relegate security checking to whatever calls the API 
> function in the first place?
> 
> Typical case of such calls is an update GUI function which does input 
> checking and then delegates the actual update to an API function. The 
> GUI function could just as easily do privilege checking, and often does 
> anyway.
> 
> Of course there are exception cases, for instance API functions that 
> create content for display, like the getmenulinks functions. There is 
> also the question of what happens when one API function calls another, 
> and so on.
> 
> Still, it seems to me that taking the removal of security checks as a 
> starting point and then dealing with the exception situations as they 
> present themselves may be a useful approach to reducing the number of 
> unnecessary checks.
> 
> Opinions?
> 
> Marc

Didn't we have this discussion before?

I don't think we can restrict SecChecks to API callers, because the 
caller may not know exactly what it is checking for, and/or may not 
implement the checks.

IMO, in some cases we should make a distinction between GUI SecChecks 
and data SecChecks.  GUI checks can be made by the caller, but data 
checks are most effective in the API itself.  The current levels don't 
reflect this distinction, and I think we've become comfortable with the 
ambiguity they present.