Re: Security Checks in API functions

Chris wrote:
>> ...
> I agree with all of the above, a problem I have found on numerous
> occasions which makes it near impossible to use module APIs outside the
> module they came with. This somewhat hampers use of those functions
> either natively, or via hooks, without having the end user jump through
> hoops creating privileges to accomodate. Which, in many cases, as Jason
> alludes to, leads to granting access to otherwise unwanted and/or
> unneccessary functions.

I think key to this is that privileges applies to data at the API level are
*silent* privileges. They simply make data appear not to be there. The APIs
should not raise errors if you try to access data that you do not have access
to; they should simply not return any data.

Privileges at the functional level are not silent - they raise errors, they tell
the user to log in, they influence the links and menus that are displayed.

For an example of where this goes wrong, we can look at xarBB. This module has
silent privilege checks in the APIs. If you do not have access to view a forum
or a post, the API simply does not return that forum or post - you have no way
to know that it even exists, since the API does not return it in any shape or
form. This poses difficulties when linking to a post from, say, an e-mail
notification. If the forum requires the user to log in, and the user is not
logged in, then the page they are taken to is simply "this forum [or post] does
not exist". The front-end has no way at all to know that it does exist and tha
the user simply needs to log in.

In that xarBB case the privilege check should not be in the API - it should be
in the front end, so that it can then make a decision on what to display. The
forum or post either really does not exist (and the user can be told) or the
user does not currently have sufficient privileges to view it.

I have actually had to modify xarBB for a client to remove those API privilege
checks for just that reason. Unfortunately the code in that module is such a
rat's nest, it is difficult to pull out any of the changes that can be pushed
back to xarBB.

-- Jason