id	summary	reporter	owner	description	type	status	priority	milestone	component	version	resolution	keywords	cc	launchpad_bug
1034	"MetadataSetter does not enforce restriction on setting ""tahoe"" subkeys"	davidsarah	davidsarah	"When the metadata of a child in a directory is updated, the ""tahoe"" subkeys are not supposed to be changed. (This is not a security restriction, since someone with a writecap to the directory could bypass it; it's just desired behaviour for normal usage.)

This behaviour is enforced by {{{Adder}}} in source:src/allmydata/dirnode.py .

However, it is not enforced by {{{MetadataSetter}}} in the same file. Currently, {{{MetadataSetter}}} is only used by the {{{set_metadata_for}}} method of dirnodes, which is not accessible via the webapi. (The webapi {{{set-children}}} operation uses {{{Adder}}}.)

Either {{{set_metadata_for}}} should be considered for removal since it is not accessible, or {{{MetadataSetter}}} should have the same behaviour as {{{Adder}}} for ""tahoe"" subkeys."	defect	closed	major	1.7.0	code-dirnodes	1.6.1	fixed	cleanup reviewed