search

UniversityRadioYork / MyRadio

University Radio York's back-end radio management system
https://ury.org.uk/myradio
16 stars 16 forks source link

SIS Obit button Subnet detection doesn't work. #631

Open mstratford opened 7 years ago

mstratford commented 7 years ago

It doesn't appear in the studios.

LloydW93 commented 7 years ago

auth_subnet was invented to grant access to services based on location. IP isn't super-secure of course, but it seems safe for URY's subnet because you wouldn't even be leaving the building in terms of traffic.

However, the auth_subnet permissions generation logic is in the deprecated (and almost entirely removed) logic of $_SESSION['member_permissions'], which was compiled once at login, which took IP into account. This code is now "dead" in MyRadio, which now users MyRadio_User->hasAuth.

However, hasAuth doesn't take auth_subnet into account.

On the "dead" code, it was kept in because at the time there were multiple services outside MyRadio which relied on this being set. In fact, ceedox/wiki things may well still depend on it.