← Back to team overview

launchpad-dev team mailing list archive

Re: using PermissiveSecurityPolicy when serving private xmlrpc requests

 

Bjorn Tillenius wrote:
> On Tue, Feb 23, 2010 at 05:56:47PM +1300, Michael Hudson wrote:
>> Hi there.
>>
>> Today's hacking has involved working on methods implemented by the
>> private xml-rpc server.  If you've done this before, you'll know that it
>> can be a bit annoying as calls to this server are not authenticated, so
>> you end up having to weaken the security declarations a whole lot or use
>> removeSecurityProxy liberally, neither of which feels very nice (I have
>> complained about this before, I think).
> 
> Can you give a list of all the methods that the private XML-RPC server
> currently implements?

OK...

This is the application root:

http://people.canonical.com/~mwh/canonicalapi/canonical.launchpad.interfaces.launchpad.IPrivateApplication.html

The 'authserver' endpoint:

http://people.canonical.com/~mwh/canonicalapi/canonical.launchpad.interfaces.authserver.html

'codeimportscheduler':

http://people.canonical.com/~mwh/canonicalapi/lp.code.interfaces.codeimportscheduler.ICodeImportScheduler.html

The 'branch_puller' endpoint:

http://people.canonical.com/~mwh/canonicalapi/lp.code.interfaces.codehosting.IBranchPuller.html

'branchfilesystem':

http://people.canonical.com/~mwh/canonicalapi/lp.code.interfaces.codehosting.IBranchFileSystem.html

'mailinglists':

http://people.canonical.com/~mwh/canonicalapi/lp.registry.interfaces.mailinglist.IMailingListAPIView.html

'bugs':

http://people.canonical.com/~mwh/canonicalapi/lp.bugs.interfaces.externalbugtracker.IExternalBugTrackerTokenAPI.html

What I'm working on is adding some methods so that code import slaves
don't need to talk to the database directly -- I guess this is why I'm
craving PermissiveSecurityPolicy so: because I'm basically moving code
from a script context to an appserver context.

Cheers,
mwh



Follow ups

References