Re: [Exist-development] [HEADS-UP] Merge in of Security Branch

[Adam R. <ad...@ex...>]

I am firstly trying to adhere to the Unix permissions model and so r and x
are required to load and then execute xquery.
On Feb 8, 2012 12:06 PM, "Dmitriy Shabanov" <sha...@gm...> wrote:

> On Wed, Feb 8, 2012 at 5:02 PM, Hungerburg <pc...@my...> wrote:
>
>> Am 2012-02-08 03:45, schrieb Joe Wicentowski:
>> >
>> > In hindsight I realize I was reading your advice below too literally.
>> > It makes sense that to "execute" a .xq via web browser, we need to not
>> > only make it "executable" but also "readable".
>> >
>> > Apologies if this is covered in basic unix permissions model, and
>> > apologies for my ignorance!
>>
>> In the unix model, scripts that are to be executed by an interpreter,
>> have to be both readable and executable by the user, while binaries,
>> that can be executed by the kernel directly only require execute
>> permission by the user. This difference does not make much sense in
>> eXist, does it?
>>
>> Requiring only exec permission for xquery procedures would allow to eg.
>> hardcode passwords in a script or use of some logic, that the executing
>> user must not learn. And after all, they are binaries in eXists native
>> object format, aren't they?
>>
>
> Yes, that is reason to keep it unreadable but executable.
>
> --
> Dmitriy Shabanov
>
>
> ------------------------------------------------------------------------------
> Keep Your Developer Skills Current with LearnDevNow!
> The most comprehensive online learning library for Microsoft developers
> is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
> Metro Style Apps, more. Free future releases when you subscribe now!
> http://p.sf.net/sfu/learndevnow-d2d
> _______________________________________________
> Exist-development mailing list
> Exi...@li...
> https://lists.sourceforge.net/lists/listinfo/exist-development
>
>