Details

      Description

      It is possible to restrict access for CMS templates to variables like $portal or $serviceLocator. Nevertheless, it is still possible to gain access to services using the getClass().forName trick, and thus any person able to create a CMS templates (even on private pages) would have possible access to much more that we would like to.

      As I see it, it would be good to somehow block accessing the forName method from Velocity (and perhaps some other similar security holes, if there are more) - however doing it, combined with restricting acess to variables like $portal, would make templates much less powerful, while portal administrators would sometimes like to utilize their most powerful abilities.

      Thus I propose adding a flag to each template, "restricted" - and allow only users with appropriate permission (which by default only OmniAdmins would have) to save a template with this flag unchecked. This way admin would be able to save template without restrictions and make it work with powerful features, and at the same time, if regular user modified this template and saved changes, the flag would get automatically checked, and his version of template would be restricted in access to fragile portal machinery.

        Attachments

        1. step1.png
          step1.png
          112 kB
        2. step1.png
          step1.png
          112 kB
        3. step2.png
          step2.png
          196 kB
        4. step3.png
          step3.png
          146 kB
        5. step4.png
          step4.png
          112 kB
        6. step5.png
          step5.png
          9 kB
        7. unrestricted_templates.patch
          69 kB
        8. unrestricted-templates.txt
          41 kB

          Activity

            People

            • Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:
                Days since last comment:
                3 years, 48 weeks, 1 day ago