Re: Security Checks in API functions

[email protected] wrote:
> Putting together some of the insights gleaned from the discussion, lets
> look at a real, "complex" case. Take for example the roles getall
> function roles_userapi_getall
> 
> I call this case complex because the function returns "nontrivial" data,
> in this case an array of roles.
> 
> - on the one hand, there is a case for having the security check for
> accessing an array of roles in the API function. The caller will be
> interested not only in the actual array returned, but if there is say a
> pager involved may also want to access the total number of array
> elements, while the actual array returned may by a subset of that. In
> order to do all this, whatever filtering happens (including security
> checks) would need to happen ideally in the function itself rather than
> the caller.

It may even be more complicated than this: not only does the caller have
privileges to fetch an item (or not), once the do have the item, they may only
have privileges to access a part of that item. It may, for example, be the full
name of a role, but with no access to the e-mail address or a hooked property.

> - on the other hand, the caller may want to check security in different
> ways: READ or EDIT access, say. This would argue for having the caller
> do the filtering.

I've certainly come across this before, but not in Xaraya. I created a DD-like
addon to the Vanilla forum that had privileges like this. You can request all
items (custom fields) that you have view access to for a user (when looking at a
user's profile) or all items that you have edit access to (when going in through
the modify screen). It works well, but I cannot think of a generic way to apply
it to Xaraya with its much more flexible and complex privileges.

> It seems that in such a case there is no clearcut solution in the way
> Xaraya currently handles such situations. I purposely picked getall
> because it appears pretty much in most modules, so this is hardly an
> uncommon situation.

One possible way to handle it would be for all content to be put into a single
module, a 'content module' if you like. If it were sophisticated enough and
handled DD-like extensions, categories, hooks, etc. then modules would not be
handling database queries or privileges directly.

> Note that if getall was returning trivial data, such as a create
> function which justs returns 0/1 on completion, the first point above
> would fall away and the case for having the security check in the caller
> would be stronger.

I think my distinction would not be between 'trivial' and 'non-trivial' data.
Instead I would split it into 'single item' or 'set of items'.

> My conclusion is that there will either be different solutions to these
> types of cases, or if a single solution then we need to rethink function
> calls such as getall.

Unfortunately that increases the development workload, as the same things keep
getting reinvented over and over. We'll get there in the end though.

-- Jason