search

tsgrp / OpenAnnotate

TSG's Browser-based Annotation Tool
8 stars 4 forks source link

Alfresco - two users with same display name can edit each others' annotations #30

Open jrubins opened 10 years ago

jrubins commented 10 years ago

Since Alfresco allows two users to have the same display name (firstName + " " + lastName), these users will be able to edit each others' annotations. This happens because we use a user's display name to identify which annotations belong to them and which don't.

This is not an issue in Documentum, since the display names must be unique for each user.

m-brouillette commented 9 years ago

As of REV:2567, we filter out any two sessions using the same name.

I wouldn't call this issue fixed, however, since we could be blocking two with the same first and last name in Alfresco, which is actually a totally legitimate use case.

I don't know if Alfresco has a separate, unique name for each user that we could use for this filtering, but that would be preferable to filtering on the display, as we do now.

dgrumieaux commented 9 years ago

In alfresco the user's login name is a unique identifier in the system.

On Mon, Jun 1, 2015 at 5:42 PM, m-brouillette notifications@github.com wrote:

As of REV:2567, we filter out any two sessions using the same name.

I wouldn't call this issue fixed, however, since we could be blocking two with the same first and last name in Alfresco, which is actually a totally legitimate use case.

I don't know if Alfresco has a separate, unique name we could use for this filtering, but that would be preferable to filtering on the display, as we do now.

— Reply to this email directly or view it on GitHub https://github.com/tsgrp/OpenAnnotate/issues/30#issuecomment-107738811.

m-brouillette commented 9 years ago

Currently we only store the user's display name as a global variable in OA, so all our checks for who owns a annotation, displaying of user's name, etc. use the same OA.displayName. We could add another variable that comes into viewer.ftl for a user's unique name (which would be the same in as display for DCTM). However, since we already use OA.displayName in a variety of places, and there are already saved annotations which use OA.displayName, if we change over to the new approach, users who's OA.displayName != OA.uniqueName would lose ownership of their old annotations.

In short, we could (and should) take the "two names" approach, but it would involve bigger changes across OA, not just in the collaboration server, and introduce some hairy backwards-compatibility issues.