aeolus security - round 2 (rev 2)

Mo Morsi mmorsi at redhat.com
Mon Jun 25 17:53:26 UTC 2012


On 06/25/2012 11:18 AM, Matt Wagner wrote:
> On Thu, Jun 21, 2012 at 04:51:48PM -0400, Mo Morsi wrote:
>> Redmine #3288, #3404, #3405
>>
>> This is the lastest revision to the latest round of security updates,
>> incorporating all feedback so far. The spec and feature suites still work
>> after these patches are applied and everything should be good to go for
>> approval
> ACK. This resend fixes the various issues with failing tests, and looks
> sane. Plus, yay for better security.


Thanks for the ACK Matt, pushed the patches, closing out the security
story for this sprint.

>
> Did we ever do anything thorough about protecting against
> mass-assignment?
>
>

We are tackling the mass-assignment issue incrementally as we go through
the model classes. For example Maros pushed this [1] with some other
security fixes a little while ago adding the attribute protection to the
credential table. The plan of attack is to continue to do this,
analysing and updating each model class in the same manner as we are
doing w/ the controllers.

Will be reorganizing and updating the security page on the wiki soon and
sending a status report to the list w/ an overall assessment. Look for
that in the near future.

  -Mo

[1]
https://github.com/aeolusproject/conductor/commit/274fb0b55fed6a6b9e597e87bce48597f3624185



More information about the aeolus-devel mailing list