[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Perl->PHP Object Security
See my reply to my own mail which already talks about what your saying i
think, and reply to that. :)
On Wed, Jan 19, 2000 at 09:57:42AM -0800, Aaron Turner wrote:
>
> On Thu, 20 Jan 2000, Jason Pincin wrote:
>
> [snip]
>
> > Here's the biggest problem I see. The php object security relies heavily
> > on http-auth to set $current_user. Anytime anyone performs an action,
> > $current_user is tested to insure they have the proper permissions to
> > perform that action. My PHP code assumes current user is correct, because
> > render.php3 will only set $current_user to a non-anonymous user given a
> > succesful http-authorization.
>
> OK.
>
> > Now - if Perl script want to operate under this security model through the
> > php-function gateway I'm creating, the gateway php script needs to set
> > $current_user.
>
> Yep.
>
> > For this to happen, we need a reliable and secure way for
> > Perl to pass the current user objectID along with the function/action
> > being done into the php gateway script.
>
> Why? Why not have the user pass their username/password? Kinda like how
> the web based webupdate works. You log in and click a button to publish.
>
> > This HAS to be secure. People
> > cannot be able to falsify this passage or anything... because my php code
> > is just going to ASSUME it's coming from a secure source... as it does
> > with http-auth. If you pass me in the object IDthat translates to "god"
> > who can do ANYTHING, then the php scripot will allow you to delete
> > KB-Root. Not a good thing. So now, you'll have to tell me how you'll
> > verify the user, and how you'll pass that ID to the php gateway script.
>
> Have your gateway script be able to do the user lookup like render.php3
> does.
>
> --
> Aaron Turner, Core Developer http://vodka.linuxkb.org/~aturner/
> Linux Knowledge Base Organization http://www.linuxkb.org/
> Because world domination requires quality open documentation.
> aka: aturner@vicinity.com, aturner@pobox.com, ion_beam_head@ashtech.net
> The difference between `Unstable' and `Usable' is only two characters: NT
--
Jason Pincin
Linux Knowledge Base Project Leader (http://www.linuxkb.org)
http://vodka.linuxkb.org/~chardros