5868 2010-09-01 22:57:00 -0700 Refactor all HandlerValidators into authorization policies (across all apps) 2012-09-21 13:13:09 -0700 1 1 1 Unclassified OJS General 3.x PC Linux NEW P3 normal --- 1 jerico.dev pkp-support alec OCS 2.3.4 OHS 2.3.2 OJS 2.3.4 OMP 1.0 21031 jerico.dev 2010-09-01 22:57:02 -0700 Todos moved over from #5540 which will have to wait for OJS 2.3.3 to be released. * Specify permissions for all apps similar to the spreadsheet that defines permissions for OMP, see https://spreadsheets.google.com/ccc?key=tw_MobQ-ZwFI1deqxdnxiIA * refactor all HandlerValidator* classes in all apps to the new policy classes * create a deprecation message whenever a HandlerValidator is instantiated or whenever a check is being found in PKPHandler::validate()/addCheck(), etc. * remove PKPHandler::getLoginExemptions() and make HandlerOperationRestrictSiteAccessPolicy::getLoginExemptions() private * remove inclusion of HandlerValidators in PKPHandler class once all handler validators have been removed. * refactor "Validation" class into "Authentication" class but maintain a deprecated Validation class for backwards compatibility This is a migration task which is also listed here: http://pkp.sfu.ca/wiki/index.php/Migration_issues#Replacing_HandlerValidators_with_AuthorizationPolicies_.28Florian.29 21035 jerico.dev 2010-09-01 23:09:18 -0700 • Add sample patches to this bug report. • a main policy (workflow stage policy) • a handler (setup handler + manager handler) • a component (e.g. sponsors grid) 21036 jerico.dev 2010-09-01 23:12:44 -0700 When you refactor code yourself you can use the following refactoring checklist which contains several checkpoints that avoid introduction of difficult-to-identify vulnerabilities: • Don't do ad-hoc policy design. Make sure you first have a full permission specification for the app you're refactoring (see the OMP permission spec as an example). • Make sure you transform validate() method calls into authorization policies (unless you really want to check non-fatal data integrity issues in the validate() method). • Remove all validate() calls in the class once you've moved the validate() code to policies. • Make sure that you have a single policy in the authorize() method that contains all other policies without duplicating code from already existing policies. • Make sure getRemoteOperations() has been removed everywhere and that a corresponding addRoleAssignment() has been added to the constructor • Make sure that you also include operations from inherited classes (e.g. "fetch", "fetchGrid", etc.) • Make sure that the $roleAssignment parameter is passed into all authorize() calls and from there into all policies. Follow the inheritance hierarchy of the policy to see whether it's correctly passing the role assignment on to the role policies. • Make sure that all policy constructor args are passed in in the right order. • Make sure that the authorize() method has the right signature. • Make sure that the parent::authorize() method is being called (go up along the inheritance hierarchy until reaching PKPHandler) • Make sure that the parent::authorize() value is actually being returned along the chain (go up the hierarchy again) and back into the router. • Make sure that you have all necessary authorization context objects made available to the component in the initialize() method. • Remove import statements to HandlerValidator. 21041 jerico.dev 2010-09-02 08:04:07 -0700 Execute the following commands within the OMP repository to retrieve sample diffs/see examples for this migration: 1) Sample policy (this shows how complex policies will look like): http://github.com/pkp/omp/blob/master/classes/security/authorization/OmpWorkflowStageAccessPolicy.inc.php 2) Sample component: http://github.com/pkp/ojs/blob/master/controllers/grid/citation/CitationGridHandler.inc.php - see constructor for role assignment - see authorize() method for policy assignment - see missing validate() method 3) Page handlers are secured in the exact same way as the sample component.