mugle-dev team mailing list archive

[Scott Ritchie <s.ritchie73@xxxxxxxxx>]

Yes, that's what prageeth's annotations do, the getter for the  
gametoken in GameData should be marked with something along the lines  
of PUBLIC=admin, PRIVATE=guest

Meaning that unless you're an admin, you can only see the gametoken if  
it belongs to a game in a devteam you are part of.  Last I checked  
these annotations worked (ie viewing a different user). Can you check  
that you're not logged in as an admin and try seeing the gametoken?



On 23/05/2011, at 10:53 AM, Matt Giuca <786685@xxxxxxxxxxxxxxxxxx>  
wrote:

> > The edit page itself should be blocked, but there's nothing  
> > stopping them from viewing those
> > fields (because they need to) if they do edit an object and pass it
> > back it will refuse to write it
>
> That's true for a few cases, but absolutely not in general. Case in
> point: The GameToken should NOT be visible to someone outside the
> devteam. I suppose all of the other fields of Game should be visible.
> Are there any other fields which should not be shown to all? If not,
> then I suppose we can make a special case for GameToken.
>
> Is there any infrastructure at the moment for denying view access on
> specific fields?
>
> --
> You received this bug notification because you are a member of MUGLE
> Developers, which is a direct subscriber.
> https://bugs.launchpad.net/bugs/786685
>
> Title:
>  Views aren't restricted by permission
>
> Status in Melbourne University Game-based Learning Environment:
>  Triaged
>
> Bug description:
>  The permissions system stops you from writing anywhere you shouldn't,
>  but there don't appear to be any restrictions on what you can view.
>  Any user can go around to #!/devteam/game/+edit and see everything
>  there, including all the badges, and the game token.
>
>  Users need to be restricted from accessing certain kinds of data.  
> Note
>  that this can't be done on the client side. The server needs to  
> refuse
>  to give you certain objects (or refuse to fill in certain fields) if
>  you ask for them.
>
> --
> Mailing list: https://launchpad.net/~mugle-dev
> Post to     : mugle-dev@xxxxxxxxxxxxxxxxxxx
> Unsubscribe : https://launchpad.net/~mugle-dev
> More help   : https://help.launchpad.net/ListHelp