Weceem

• Type: Task
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: None
• Fix Version/s: 0.9
• Component/s: None
• Labels:

  None

As of the ability to create content via the content submission controller, this needs to be restricted so that attackers cannot create new dynamic script nodes remotely instead of blog comments!

The syntax implemented is as follows:

"ROLE_USER" {
       view true
       create [org.weceem.content.HTMLContent, org.weceem.content.Comment]

      "/blog" {
             create [org.weceem.blog.BlogEntry]
      }
}

"ROLE_GUEST" {
       view true
       create [org.weceem.content.Comment]
}

• Assignee:

  Marc Palmer

  Reporter:

  Marc Palmer

• Created:

  20/Jan/10 2:57 PM

  Updated:

  28/Jun/10 11:13 AM

  Resolved:

  28/Jun/10 11:13 AM