[Exist-development] Granular access to system functions, WAS: util:system-property() should run under dba

[Thomas W. <tho...@gm...>]

James,

I think we need to define the access to the variety of system commands on a
more granular level.

 I would like to propose a design that will not only keep the current
execution restrictions but also adds an option to grand access to a module
or even to a specific function to group.

For every function that needs to have a controlled manner of execution, we
can have a list of group names that are allowed to call this function. The
default group names are DBA and a group with name as the name of the
module. Then every eXist instance may add application specific groups with
rights to execute a function or all functions for a module.

We can have the default list of groups in a config file that will be
imported into the db initially and later only the db  version will be used.

What do you think?

Thomas

------

Thomas White

Mobile:+44 7711 922 966
Skype: thomaswhite
gTalk: thomas.0007
Linked-In:http://www.linkedin.com/in/thomaswhite0007
facebook: http://www.facebook.com/thomas.0007



On 29 July 2010 09:06, James Fuller <jam...@ex...> wrote:

> on second thought I would let it run under guest but only basic
> properties (vendor, vendor-url, etc)
>
> when run under dba java properties get exposed.
>
> On 29 July 2010 09:55, Evgeny Gazdovsky <gaz...@gm...> wrote:
> > Sure!
> >
> > Also, suggest add the config doc into system collection,
> > where we can setup the the xquery URI scripts, which
> > can use some functions from other user without password.
>
> unsure what you mean by config doc ...  do you mean, for example, the
> 'load function documentation'  which runs under admin now ?
>
> J
>
>
> ------------------------------------------------------------------------------
> The Palm PDK Hot Apps Program offers developers who use the
> Plug-In Development Kit to bring their C/C++ apps to Palm for a share
> of $1 Million in cash or HP Products. Visit us here for more details:
> http://p.sf.net/sfu/dev2dev-palm
> _______________________________________________
> Exist-development mailing list
> Exi...@li...
> https://lists.sourceforge.net/lists/listinfo/exist-development
>