W3C home > Mailing lists > Public > w3c-dist-auth@w3.org > July to September 2003

RE: ACL and lockdiscovery

From: Lisa Dusseault <lisa@xythos.com>
Date: Wed, 17 Sep 2003 16:49:20 -0700
To: "'Eric Sedlar'" <eric.sedlar@oracle.com>, "'Horst Liermann'" <horst.liermann@ixos.de>, <w3c-dist-auth@w3.org>
Message-ID: <008b01c37d76$5106f810$f8cb90c6@lisalap>

I'd also point out that the lockdiscovery property MUST contain
all the lock tokens, regardless of access control settings.  This
is not considered a security leak, because authorization is also
needed to use a lock token.  So this is the server logic to apply
whenever the client provides a lock token: 

Is this the same authorization context that took out the lock? 
  Yes {
	Allow the operation normally, provided the operation is 
	allowed, and provided the lock token is correct and all
	required lock tokens are provided, etc.
  } No {
	Is this an UNLOCK operation, with an authorization that
	includes permission to delete others' locks?
	Yes {
		perform UNLOCK
	} No {
		Fail request
	}
  }

Lisa

> -----Original Message-----
> From: w3c-dist-auth-request@w3.org 
> [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric Sedlar
> Sent: Wednesday, September 17, 2003 11:17 AM
> To: 'Horst Liermann'; w3c-dist-auth@w3.org
> Subject: RE: ACL and lockdiscovery
> 
> 
> 
> The ACL spec hasn't defined a privilege specifically to 
> control read access to the lockdiscovery property, or even a 
> privilege to control access to all the privileges in total.  
> An individual server implementation could provide such a 
> privilege and aggregate it under <dav:read>, but this isn't required.
> 
> --Eric
> 
> > -----Original Message-----
> > From: w3c-dist-auth-request@w3.org 
> > [mailto:w3c-dist-auth-request@w3.org]
> > On Behalf Of Horst Liermann
> > Sent: Wednesday, September 17, 2003 10:08 AM
> > To: 'w3c-dist-auth@w3.org'
> > 
> > 
> > Hi all,
> > 
> > some questions about lockdiscovery and ACL's
> > 
> > Suppose, you have a server with WebDAV ( including lock) and it 
> > support's ACL. What is the behavior for lockdiscovery, can 
> I see all 
> > lock token or am I only allowed to see the tokens where I 
> am the owner 
> > of the lock ? As far as I understand, lockdiscovery reports 
> all locks. 
> > Is this a security leak ?
> > 
> > Best Regards
> >    Horst
> 
> 
> 
Received on Wednesday, 17 September 2003 19:49:28 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Tuesday, 2 June 2009 18:44:04 GMT