Re: silvafind

security:

"Fixed security issues. If user does not have view permission on an  
object,
   textsnippets show "You don't have the right permissions to view  
this."
   Not an ideal solution, but we don't want to wakeup all objects in
   searchresults to filter, and we don't want to do this in getbatch  
because it
   would screw up the resultcount."

very nice. BUT: do we really want to see that we are not allowed to  
access certain items? e.g. i have a protected folder with 4 items.  
the search result contains among other things this list:

[cut]
12. You don't have the right permissions to view this.
13. You don't have the right permissions to view this.
14. You don't have the right permissions to view this.
15. You don't have the right permissions to view this.
[cut]

interesting. now i search for "password" (andy's example) and the  
result is:

14. You don't have the right permissions to view this.

more interesting. although i have no permission to view the 14th  
document i know now that it contains the word "password"... even more  
interesting. because we are paranoid about security we can not allow  
this type of "peeking" into protected content;-)

consequently, the code MUST be changed so that objects are not shown  
at all where i don't have access permissions. because i cannot  
complain and criticize all the time i'd like to present my 1-line of  
code solution for this problem which does not "screw up the  
resultcount". writing the code took me 10 minutes but coming up with  
this solution took me 2 hours; as always i was testing with much too  
complicated code at the beginning.

briefly: instead of checking if an object is viewable for the user  
during the creation of the result list (in the batch loop) i do it  
beforehand. so the solution is as following:

replace this line in SilvaFind/views/public/SilvaFind/render_helper.pt:

     results python:resultparts[0];

with this line:

     results python:[item for item in resultparts[0] if  
model.isViewableForUser(item)];

done.

well, not yet. quite a few lines of code can now be kicked out of or  
simplified in render_helper.pt and there is no need to  
internationalize "You don't have the right permissions to view this.";-)

what about the performance impact because of this additional loop? i  
guess (but i don't have any hard figures) that overall the search  
results are presented faster because the second batch loop is smaller  
and there are less conditions to be evaluated and less translations  
to be made.

regards,
marc


this is the first time in my life that i have created a patch file.  
hopefully it is correct.

--- render_helper.pt.orig       2007-03-16 00:04:47.000000000 +0100
+++ render_helper.pt    2007-03-16 01:50:58.000000000 +0100
@@ -53,7 +53,7 @@
<div class="searchresults"
    tal:define="
      resultparts python:model.searchResultsWithDescription(request);
-    results python:resultparts[0];
+    results python:[item for item in resultparts[0] if  
model.isViewableForUser(item)];
      msg python:resultparts[1];
      columnTitles model/getResultsColumnTitles;
      batch python:template.getBatch(results);
@@ -112,8 +112,7 @@
<ul tal:condition="batch">
    <li tal:repeat="item batch">
      <tal:block define="ix repeat/item/index;
-      fields python: model.getPublicResultFieldViews();
-      allowed python:model.isViewableForUser(item)"
+      fields python: model.getPublicResultFieldViews()"
        condition="fields">
        <div class="searchresult">
          <tal:block repeat="field fields">
@@ -124,11 +123,8 @@
              tal:content="string:${num}.">
              count
            </span>
-          <span class="searchresult-notallowed"
-                tal:condition="python:not allowed and field.getName 
() == 'link'"
-                i18n:translate="">You don't have the right  
permissions to view this result.</span>
            <tal:block define="result python:field.render(context,  
item)"
-            condition="python:allowed and field.getName() !=  
'resultcount'">
+            condition="python:field.getName() != 'resultcount'">
              <span tal:condition="python:same_type(result, [])"
                tal:repeat="item result"
                tal:replace="structure item" />

_______________________________________________
silva-dev mailing list
[email protected]
https://infrae.com/mailman/listinfo/silva-dev