Timeline for How safe is using ElevatedPrivilegesScope to access a Component Tridion, if it is not accessible by the user
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 20, 2020 at 9:58 | comment | added | Neelesh Raghuvanshi | Thanks @NunoLinhares for your help, | |
| Feb 20, 2020 at 9:57 | vote | accept | Neelesh Raghuvanshi | ||
| Feb 20, 2020 at 9:39 | answer | added | Peter Kjaer | timeline score: 4 | |
| Feb 20, 2020 at 8:20 | comment | added | Nuno Linhares♦ | Sorry, apparently it wasn't clear. You are not elevating the user's privilege, you are elevating the Session privilege. User is not in the same session, if he logs in via CME, the user is using a different session. | |
| Feb 19, 2020 at 17:16 | comment | added | Neelesh Raghuvanshi | Thanks @NunoLinhares for your comments, we have image size checker event system code which basically restrict Content editors to add high size images, this image configuration component we are reading in Event system using current component session, but as i said this fails if the Content editor does not have access to the publication where the configuration component resides. If privileges does not revoke for some reasons then the same user will not see the all publication in the CME? (As he is in the same session and cme is accessible because one of the pro cme node is still up?) | |
| Feb 19, 2020 at 17:04 | comment | added | Nuno Linhares♦ | Privilege Elevation is only applicable to the session you are creating, not for other sessions. The use case is really for when you need to do something programmatically that the user cannot do - but you still want to make sure it's traceable back to this user. | |
| Feb 19, 2020 at 16:58 | history | asked | Neelesh Raghuvanshi | CC BY-SA 4.0 |