Project

General

Profile

Task #1331

Story #1329: ^^^^ Items To Discuss ^^^^

Possibly combine MN_crud.create() and MN_crud.update()

Added by Roger Dahl almost 12 years ago. Updated almost 12 years ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
-
Target version:
-
Start date:
2011-02-09
Due date:
% Done:

0%

Milestone:
Product Version:
*
Story Points:
Sprint:

Description

Maybe we should combine MN_crud.create() and MN_crud.update() because both take a SysMeta object that contains the obsoletes and obsoletedBy fields, and a single call could do the appropriate thing based on that information.

History

#1 Updated by Matthew Jones almost 12 years ago

I don't think so. The problem is that update() needs to enforce different access control rules than create(). Otherwise, any user could replace the content of any other user. The receiving MN should not be just trusting that the sysmeta provided by the user is right -- the MN needs to verify that the user has the rights to make those sysmeta changes. I think two distinct APIs helps to signify this critical distinction in the two operations (one creates a new object, the other creates a new object but replaces an existing object, thereby incurring an access check).

Also available in: Atom PDF

Add picture from clipboard (Maximum size: 14.8 MB)