https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26129
--- Comment #59 from Tomás Cohen Arazi (tcohen) <[email protected]> --- (In reply to David Cook from comment #58) > I decided to stay late and do a quick look... and overall it seems pretty > straightforward since it's just the skeleton and none of the muscle/meat. I > was getting excited to mark it with my SO and mark Passed QA. > > But there's 1 problem and that's permissions. > > I can't sign off on this at the moment, because the API permissions are > 'parameters: "*"' and there is no further authorization beyond that. > > -- > > So let me propose something... what about a "permissions" column? When > creating a row in "configurations" you must specify the permission required > for that configuration. > > When you're fetching, updating, or deleting that row, the API user has to > have that permission. > > In this way, "configurations" can be dynamic yet still strongly protected. > > -- > > It does present some difficulties with Koha Plugins, but... that's already a > separate issue, and this change would be extensible enough to accommodate > future permissions added, so I think it would be OK. I love this. -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
