[gbd-dev] Global and local settings

[Linus M. <Li...@mc...>]

Hello

Here's an attempt to summarize the discussions on security, global and user 
settings, and temporary overriding of settings:

1) New setting items are added, 
  * allow remote clients
  * enable developer help
  * allow user override on http request
  * allow settingsfile override on http request
  * allow host and port override on http request (or do we need separate 
settings for these?)

These items will reside in a file 'globalsettings.php' which will work similar 
to how localsettings does today. 
This file will have the required comments to make sure the user understand 
what s/he enabling.

2) After this file is read, Gubed will optionally look for a user settings 
file but this file is not a php file but a config file (parse_ini_file helps 
here) so that only allowed settings can be changed.

To find the correct user config file, Gubed will search in the following 
locations and take the first one it finds:
  * file specified on http request - if this is allowed in global settings
  * localsettings_{$user}.ini where $user is specified on http request and 
user overriding is enabled in global settings.
  * localsettings_{$user}.ini where $user is $_SERVER["REMOTE_USER"].
  * localsettings.ini - is this really needed?

3) After the user settings is read, optionally host and port may be changed by 
the http request if this is allowed by the global settings.

4) The developer helper scripts are updated to only work if they are enabled.

5) We will have to remember that this must all work also when not using 
StartSession

Did I forget anything?

/Linus