Adding a manuscript as new version should be restricted to the authors of the previous version

[mhdirkse]

[AX-26] created by mdi

[mhdirkse]

by dirkse

[mhdirkse]

This is a security breach. Say author X published something. The an arbitrary person Y can add a new version of the manuscript. This way, X's process of publishing something can be hijacked.

[mhdirkse]

This task is more complex than I expected. First, I am not completely sure what check we need. Here are a few possibilities:

i)

We can check that the signer of the new version is a signed author of the previous version. This has as a drawback that any author can grab exclusive access to the manuscript thread. A rogue author can create a bogus version that no-one else wants to sign for as author. Then the rogue author is the only one who can make submit versions after that.

ii) We can check that the signer is a signed author of any preceding version in the thread. This is more complicated to implement because it must be checked that there is consensus on the list of persons that are allowed to create a new manuscript. The manuscript create new version command needs a field containing these person ids. The blockchain needs to read all preceeding manuscript addresses to check the supplied list.

In any case, there is are complicated tests in the file command/manuscript_test.go. These tests are difficult to read and update. These tests should be replaced by something simpler before manuscript handling in the blockchain can be updated.

At this stage of the project it is important to have a demo. Security flaws can be addressed later. Therefore I postpone further work on this issue.