jdickey
commented
8 years ago Looking at the old code for the Virtus-based form object, the current user name and author name are separate attributes, that then must be validated as having the same value. This seems so wrong; instead, the current user name, after checking that it's an authenticated Member, should be the author name. Odd that nobody ever caught that.
Further, the passed-in repository collaborator is used only to persist the Prolog::Core::Article instance which uses the form object as the source of its attribute (field) values.
The authoriser is used in two places:
- In the
#logged_in?method called from#all_preconditions_met?, it's queried as to whether the current user is a#guest?; and - in the
#form_paramsmethod which builds a Hash used to instantiate the#form_object, its#current_usermethod is called to provide a value for a:current_userHash item — in a Hash into which the parameters supplied to#callare merged into. (If the call parameters include a (defective or malicious) value for:current_user, that value will overwrite the authoriser's value. Not good.)
Right; now that we've seen several sterling examples of what not to do, on with the show.
We've created a spec for an updated Publish a New Article use case, replacing the one implemented in Gem Release 0.3.0.
It is our feeling that this should not be "slipstreamed" into a Gem release addressing other features, but should instead be a separate, standalone Gem release, particularly as there are several implementation-policy implications associated with it, as described in the Further Considerations section of that spec.
Accordingly, this is being assigned initially to the Meldd 0.5 milestone, rather than to any Gem release presently in work as this issue is opened. It is being marked as a "bug" because the present implementation has an interface which is importantly highly inconsistent with later-established idioms.