RE: ACL and lockdiscovery

I'd also point out that the lockdiscovery property MUST contain
all the lock tokens, regardless of access control settings.  This
is not considered a security leak, because authorization is also
needed to use a lock token.  So this is the server logic to apply
whenever the client provides a lock token: 

Is this the same authorization context that took out the lock? 
  Yes {
	Allow the operation normally, provided the operation is 
	allowed, and provided the lock token is correct and all
	required lock tokens are provided, etc.
  } No {
	Is this an UNLOCK operation, with an authorization that
	includes permission to delete others' locks?
	Yes {
		perform UNLOCK
	} No {
		Fail request
	}
  }

Lisa

> -----Original Message-----
> From: w3c-dist-auth-request@w3.org 
> [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric Sedlar
> Sent: Wednesday, September 17, 2003 11:17 AM
> To: 'Horst Liermann'; w3c-dist-auth@w3.org
> Subject: RE: ACL and lockdiscovery
> 
> 
> 
> The ACL spec hasn't defined a privilege specifically to 
> control read access to the lockdiscovery property, or even a 
> privilege to control access to all the privileges in total.  
> An individual server implementation could provide such a 
> privilege and aggregate it under <dav:read>, but this isn't required.
> 
> --Eric
> 
> > -----Original Message-----
> > From: w3c-dist-auth-request@w3.org 
> > [mailto:w3c-dist-auth-request@w3.org]
> > On Behalf Of Horst Liermann
> > Sent: Wednesday, September 17, 2003 10:08 AM
> > To: 'w3c-dist-auth@w3.org'
> > 
> > 
> > Hi all,
> > 
> > some questions about lockdiscovery and ACL's
> > 
> > Suppose, you have a server with WebDAV ( including lock) and it 
> > support's ACL. What is the behavior for lockdiscovery, can 
> I see all 
> > lock token or am I only allowed to see the tokens where I 
> am the owner 
> > of the lock ? As far as I understand, lockdiscovery reports 
> all locks. 
> > Is this a security leak ?
> > 
> > Best Regards
> >    Horst
> 
> 
>

Received on Wednesday, 17 September 2003 19:49:28 UTC