[jbossseam-issues] [JBoss JIRA] Updated: (JBSEAM-2114) Feeds should honor access levels
[ http://jira.jboss.com/jira/browse/JBSEAM-2114?page=all ]
Christian Bauer updated JBSEAM-2114:
------------------------------------
Summary: Feeds should honor access levels (was: Feed servlet does not filter
access level)
Issue Type: Feature Request (was: Bug)
This is not really a bug because only GUEST_ACCESS_LEVEL documents are ever pushed onto
feeds. However, for the forum we need permissions on feeds anyway, so I'm going to
implement HTTP authentication for any feed that is associated with a !guest-readable
directory. Feed readers seem to support authentication.
Feeds should honor access levels
--------------------------------
Key: JBSEAM-2114
URL: http://jira.jboss.com/jira/browse/JBSEAM-2114
Project: JBoss Seam
Issue Type: Feature Request
Components: Wiki
Reporter: Christian Bauer
Assigned To: Christian Bauer
The FeedDAO uses the restrictedEntityManager but there are no access permission checks on
the feed entries. This might require an additional READ_ACCESS_LEVEL column on the feed
entry table. Currently anyone can access a feed if they know the identifier, even if they
have no permission to access the directory/documents!
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira