Re: NPE in ScarabModule.compareTo

Mick Semb Wever wrote:

>> How is null entries getting into the groups list returned by
>> ScarabModulePeer.doSelect(criteria);
>> that is called in ScarabDBSecurityService.getGroups(..)
>
>It's not a null entry but a group without a name, which supports my 
>suspecion that it's related to the empty TURBINE_GROUP.
>
>But... TURBINE_GROUP looks to have always been empty, so how this ever 
>worked i'm stumped!

Now I remember:
In b21 and older Anonymous and Administrator really didn't have any roles assigned.
Instead they were treated specially in the code.
I removed that special treatment and added some regular role-assignments to the initial data set.
But I forgot to add a migration script for existing scarab-installations. I'll fix this.

IMO there should be as less special treatment of a user as possible. 
Ideally a user should be able to perform exactly that actions which are allowed by the roles that are explicitly granted to him, no more, no less.
This keeps the implementation simple and makes it also easy for a non-programmer to determine which actions are allowed to a user.
If  you really want to ensure, that a new user automatically has at least the same permissions as Anonymous, then I would prefer your option 2.

Ronny