RE: [Dnfbb-developers] Validating posts/topics/forums/categories

[Bosanquet, S. <sim...@tr...>]

Si,

Has this been resolved or should I comment on this?

Simon

-----Original Message-----
From: dnf...@li...
[mailto:dnf...@li...] On Behalf Of Si
Carter
Sent: 27 February 2006 15:32
To: dnf...@li...
Subject: [Dnfbb-developers] Validating posts/topics/forums/categories

Its just occurred to me that there could be a potential issue when
validating posts, topics, forums and categories.  I thought I'd share it
here to see if its just my thinking :-)

At the moment any validation is done by verifying the existence of the
ID,
this could potentially open up a hole where a user on board 1, who has
the
rights to delete a topic, can delete a topic on board 2.  This occurs
because only the existence of the id is verified.  What I think we need,
and
this is where I need some verification as I don't want to add too much
overhead, is a series of functions which will take the id in question,
along
with the user id and verify that this user has access to the specified
ID
for posts, topics, forums and categories.  I have picked on the user id
as
this is returned for all external functions, those that begin DNF_, when
a
call to DNF_CHECK_TASK_PERMISSIONS is made.

Any thoughts welcome.

Rgds

Si




-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting
language
that extends applications into web and mobile media. Attend the live
webcast
and join the prime developer group breaking into this new coding
territory!
http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D110944&bid=3D241720&dat=3D=
121642
_______________________________________________
Dnfbb-developers mailing list
Dnf...@li...
https://lists.sourceforge.net/lists/listinfo/dnfbb-developers