#1034 closed defect (fixed)

MetadataSetter does not enforce restriction on setting "tahoe" subkeys

Reported by: davidsarah Owned by: davidsarah
Priority: major Milestone: 1.7.0
Component: code-dirnodes Version: 1.6.1
Keywords: cleanup reviewed Cc:
Launchpad Bug:

Description (last modified by davidsarah)

When the metadata of a child in a directory is updated, the "tahoe" subkeys are not supposed to be changed. (This is not a security restriction, since someone with a writecap to the directory could bypass it; it's just desired behaviour for normal usage.)

This behaviour is enforced by Adder in source:src/allmydata/dirnode.py .

However, it is not enforced by MetadataSetter in the same file. Currently, MetadataSetter is only used by the set_metadata_for method of dirnodes, which is not accessible via the webapi. (The webapi set-children operation uses Adder.)

Either set_metadata_for should be considered for removal since it is not accessible, or MetadataSetter should have the same behaviour as Adder for "tahoe" subkeys.

Change History (5)

comment:1 Changed at 2010-05-11T01:07:46Z by davidsarah

  • Description modified (diff)

comment:2 Changed at 2010-06-01T04:44:08Z by davidsarah

  • Milestone changed from 1.8.0 to 1.7.0
  • Owner set to davidsarah
  • Status changed from new to assigned

The SFTP code now uses set_metadata_for; this issue will be fixed at the same time as #1063.

comment:3 Changed at 2010-06-01T05:32:03Z by davidsarah

  • Keywords review-needed added
  • Owner changed from davidsarah to zooko
  • Status changed from assigned to new

comment:4 Changed at 2010-06-03T04:25:28Z by davidsarah

  • Keywords reviewed added; review-needed removed
  • Owner changed from zooko to davidsarah
  • Status changed from new to assigned

zooko reviewed this over irc.

comment:5 Changed at 2010-06-08T04:34:53Z by davidsarah

  • Resolution set to fixed
  • Status changed from assigned to closed
Note: See TracTickets for help on using tickets.