Re: [Sandweb-users] security issue for sandweb

[Rob H. <ro...@ro...>]

Hello,


This isn't really SandWeb's job, being a client. It may or may
not be installed where the repository is installed, and it's 
not SandWeb's place to manipulate the repo directly in any way.

SandWeb has an authentication system because it's a web-based
service, and it's just not secure not to. Think about this the
same way you think about logging into your workstation, especially
if your workstation is accessible from anywhere in the world.

The authentication information that you enter in the "repository"
menu is what enables this, however. You need to set these permissions
on the repository side.

I have done this in CVS before so I'll comment on that.

In my opinion, the best way to do this is on a per-module
basis, and create ampersand modules : 
http://www.cvshome.org/docs/manual/cvs_18.html#SEC160

For example you might have modules like :

lib/
doc/
app/

You could have an ampersand module that would be the name of
your program ( e.g. "sandweb" ), but would really just check out
these three modules.

You could have a "cvs-doc", "cvs-lib" and "cvs-app" group that owns
each module, and only the people in those groups could have write
access ( or read access, or whatever ).

Alternatively, you can just change the group permissions on directories
inside the repository, it's not quite as nice as the module setup
but it works.



HTH,
Rob Helmer

On Thu, Feb 06, 2003 at 04:18:29PM +0000, lu fang wrote:
> Hi,
> I am wondering that we may specify different previlege for different users 
> of sandweb. Since each user have a user name and password, why can't they 
> get different previlege on file viewing/editing? For some files,they can be 
> viewed by every user, but for some specified files,only some of the users 
> can access to it.
> I 'm just thinking about this issue but have no idea to make it yet. I am 
> not sure whether current version of sandweb already covered this security 
> issue becos I haven't tested all the functions of sandweb yet.But hope get 
> some discussion here.
> 
> kaguya
> 
> 
> 
> 
> 
> _________________________________________________________________
> Ãâ·ÑÏÂÔØ MSN Explorer:   http://explorer.msn.com/lccn/  
> 
> 
> 
> -------------------------------------------------------
> This SF.NET email is sponsored by:
> SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
> http://www.vasoftware.com
> _______________________________________________
> Sandweb-users mailing list
> San...@li...
> https://lists.sourceforge.net/lists/listinfo/sandweb-users
>