This repository has been archived on 2024-08-19. You can view files and clone it. You cannot open issues or pull requests or push a commit.

zotlabs 58aa0f3e1a code_allowed is a real mess. Start the cleanup by remving the account level code allow and limiting to specific channels only. This reduces the possibility of cross channel security issues coming into play. Then provide a single function for checking the code permission. This is only partially done as we often need to check against the observer or logged in channel as well as the resource owner to ensure that this only returns true for local channels which also own the requested resource.

2017-03-13 16:19:47 -07:00

43 KiB

Raw Blame History

View Raw