[opencms-dev] Multitenant configuration

[Alessandro Magnolo]

It gets worse: if you use the DownloadGalleryWidget layout widget, a
user can write in any folder of the entire opencms installation, even
in folders where he can't write using the workplace (AKA Explorer
view).

In other words, the DownloadGalleryWidget bypasses the permission
checks on the VFS, that normally don't allow an OU user to write in
other OUs folders. This is extremely dangerous.


Alessandro Magnolo


On Wed, Dec 5, 2012 at 11:53 AM, Kunicke, Holger
<holger.kunicke at av-studio.de> wrote:
> Hello List,
>
> does everybody knows a possibility to restrict the automatism of an
> "OpenCmsVfsFile" field, which transforms absolute into relative URLs, to an
> OU or deactivate this completely?
>
> My reason for this question is:
> We have more clients in one CMS and the probability is given that our
> clients creates links between them.
>
> Regards
> Holger
>
> _______________________________________________
> This mail is sent to you from the opencms-dev mailing list
> To change your list options, or to unsubscribe from the list, please visit
> http://lists.opencms.org/cgi-bin/mailman/listinfo/opencms-dev
>
>
>
>