Beefy Boxes and Bandwidth Generously Provided by pair Networks
Welcome to the Monastery
 
PerlMonks  

Comment on

( #3333=superdoc: print w/replies, xml ) Need Help??

Just to give you a taste of what I am doing and why, here's a (heavily edited) version of the dispatch code.

my %page_control = ( edit => { product => { page => 'ps-main-product-edit.tmpl', function => \&edit_product }, }, default => { page => 'ps-main.tmpl', function => '' } ); # not worried about auto-vivification because false entries will g +o to defaults my ( $page, $function ); if ( $action and $type ) { $page = $page_control{ $action }{ $type }{ page }; $function = $page_control{ $action }{ $type }{ function }; } $page ||= $page_control{ default }{ page } my $permissions = $sec->get_permissions( $section ); if ( $action and $page =~ /^$secured/ ) { if ( exists $page_control{ $action } and exists $page_control{ $action }{ $permType } and ! $permissions->{ $type }{ $action } ) { my $article = $type =~ /^[aeiouAEIOU]/ ? 'an' : 'a'; $sec->force_logout( "$user tried to $action $article $type +." ); } } # call correct function my ( $template_data, $new_page ) = $function->( $query, $db, $mod, + $sec ) if defined $function and $function; $page = $new_page if defined $new_page and $new_page; $template->process( $page, $template_data ) or dienice $template-> +error();

Basically, I use the hash to assign pages and functions for each action (permission) and type (section). We then call the function with all the data that it will need and it returns template data and, if necessary, a new page to send the user to. All functions have the same inputs and outputs.

The problem, as I see it, is how the permissions model is set up to prevent people from gaining access to something that they shouldn't. If I start building in a bunch of special cases into the dispatch code, I'm concerned that now, or in maintenance, we'll overlook something in the security portion. Since that's relatively stable, I really want all changes to occur after security has been nicely wrapped up.

Cheers,
Ovid

Join the Perlmonks Setiathome Group or just click on the the link and check out our stats.


In reply to (Ovid) Re: Re: Would you use 'goto' here? by Ovid
in thread Would you use 'goto' here? by Ovid

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post; it's "PerlMonks-approved HTML":



  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.
  • Log In?
    Username:
    Password:

    What's my password?
    Create A New User
    Chatterbox?
    Corion had a meeting with some startup today. They have a very interesting DB proxy product, but their tech stack is really, really weird. They use the Pg wire protocol but not the Pg libraries to handle it. They support Pg SQL syntax, but don't use ...
    [Corion]: ... the Pg parser (or so they claim).
    [Corion]: Also, they rolled their own user management instead of supporting LDAP for user/role management, but that just shows that they're new in the enterprise market :)
    Corion also just now realizes they didn't leave business cards.
    [erix]: can you drop a name? :)

    How do I use this? | Other CB clients
    Other Users?
    Others cooling their heels in the Monastery: (13)
    As of 2018-04-19 12:19 GMT
    Sections?
    Information?
    Find Nodes?
    Leftovers?
      Voting Booth?
      Notices?