Re: silvafind

Hi!

Andy Altepeter wrote:
> Greetings,
> 
> I'm excited to be eventually using SilvaFind at some point.  I wrote a small 
> search based on the old silvasearch files found in the layout, for my 
> SilvaWikiToolbar product, and had encountered this question already:
> 
> 
>>> what about security? who can use silvafind? what about protected
>>> content? are the different zope an public silva roles respected,
>>> especially fulltext results?
>> This should be investigated further. Content that is not viewable should
>> not end up in the search. If it does end up in the search, the login box
>> would appear since anonymous users would not have enough priviledges to
>> view this. So I don't think there are security issues, just some
>> annoyances.
> 
> It sounds like SilvaFind generates highlighted output of the body of 
> documents.  Documents that are protected from the user performing the search 
> should not see this text.  Say, for example, you have passwords or other 
> sensitive short text in your non-public document.  If an unauthenticated user 
> searchs for the text 'password', you may actually see passwords within the 
> search results :-)

The CMF implements this with a 'allowedRolesAndUsers' KeywordIndex,
which is a list of roles and users with the view permission.  Then,
everytime before you query the catalog, you add the current user's roles
to the search arguments.

Hope this helps,
-- 
Daniel Nouri
Infrae × http://infrae.com