search

plomino / Plomino

Powerful and flexible web-based application builder
33 stars 37 forks source link

too hard to make documents private #744

Open djay opened 8 years ago

djay commented 8 years ago

User problem

Imagine a system that has some data which the user enters but then some system generated data, or special reference data thats imported. You want to protect the user documents with Plomino_readers so only they can read their own documents, but you want all other data to be secure. Only formulas can access that data.

Currently what you have to do is:

  1. change your code such that any private data created has Plomino_readers set to a private group.
  2. change all your formulas that instead of accessing this data directly, to use an agent.
  3. Write an agent. Set it to run as owner and set the owner to someone in the private group (this can't be done as part of the database xml, has to be a manual step).
  4. Next you have an issue that an agent is now openly accessible. To solve this you need some secret shared between the formulas and the agent such as a shared key argument.

    Options

    security on views/agents/forms

We able to set make any of these private and only accessible to formulas or select people.

private by default

Have a switch that sets all documents to be private to everyone except formulas if they have no Plomino_readers set

??

ebrehault commented 8 years ago

It is quite easy to change the default behavior, for now if Plomino_Readers does not exist, we default to ['*'] (see https://github.com/plomino/Plomino/blob/master/src/Products/CMFPlomino/document.py#L312 ), we could replace that with [db.DEFAULT_SECURITY], and manage this DEFAULT_SECURITY param as a db settings.

djay commented 8 years ago

@ebrehault I think that might help but it only solves part of the problem. That would still require the use of some special group/user and changing your code around to use agents. Is it possible to query the data in formula in such a way as to bypass plomino readers so formulas don't have to use an agent? Seems to be that formulas have access to enough apis that they could access that data regardless right?

ebrehault commented 8 years ago

We have that for index search (with the only_allowed param: https://github.com/plomino/Plomino/blob/master/src/Products/CMFPlomino/index/index.py#L158 ), but I do not know what it takes to generalize this principle.

By the way, in Rapido, that's how it works: a formula can change any record.