+1
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Sunday, March 01, 2015 3:34 PM
> To: Sling Developers
> Subject: [VOTE] Release Apache Sling Commons Scheduler 2.4.6
>
> Hi,
>
> We solved 1 issue in this release:
> https://issues.a
+1
Best regards
mike
> -Original Message-
> From: Stefan Seifert [mailto:sseif...@pro-vision.de]
> Sent: Thursday, September 25, 2014 11:23 AM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling Testing Resource Resolver Mock version
> 0.3.0
>
> Hi,
>
> We solved 4 issues
Hi,
The vote has passed with the following result :
+1 (binding): Robert Munteanu, Carsten Ziegeler, Mike Müller
I will copy this release to the Sling dist directory and
promote the artifacts to the central Maven repository.
Best regards
mike
+1 best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Wednesday, September 17, 2014 3:23 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling Auth Core 1.3.0
>
> Hi,
>
> We solved two issue:
> https://issues.apache.org/ji
+1
Best regards
mike
> -Original Message-
> From: Robert Munteanu [mailto:romb...@apache.org]
> Sent: Wednesday, September 17, 2014 8:34 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling DavEx Access to repositories 1.2.2
>
> Hi,
>
> We solved 1 issue in this release:
+1
> -Original Message-
> From: Mike Müller [mailto:mike...@mysign.ch]
> Sent: Wednesday, September 17, 2014 2:19 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling Resource Access Security version 1.0.0
>
> Hi,
>
> It's time to make
Hi,
It's time to make a first release of the Resource Access Security bundle.
There's a lot of test coverage and the feature set includes access controlling
on all CRUD
operations.
Staging repository:
https://repository.apache.org/content/repositories/orgapachesling-1122/
You can use this UNIX
Welcome on board Stefan!
Best regards
mike
> -Original Message-
> From: Stefan Seifert [mailto:sseif...@pro-vision.de]
> Sent: Monday, September 08, 2014 9:21 PM
> To: dev@sling.apache.org
> Subject: RE: [ANN] New Apache Sling Committer: Stefan Seifert
>
> thank you very much!
>
> a few
+1
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Thursday, August 28, 2014 9:33 AM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling API 2.8.0, take II
>
> Hi,
>
> We solved 3 issues
> https://issues.apache.org/jira/
+1
Best regards
mike
> -Original Message-
> From: Robert Munteanu [mailto:romb...@apache.org]
> Sent: Monday, August 25, 2014 6:35 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling Default POST Servlets 2.3.6
>
> Hi,
>
> We solved 1 issue in this release:
> https://iss
+1
Best regards
mike
> -Original Message-
> From: Robert Munteanu [mailto:romb...@apache.org]
> Sent: Monday, August 25, 2014 5:30 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling JSON Library 2.0.8
>
> Hi,
>
> On the road for the Sling 7 release ...
>
> We solved 3
+1
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Friday, August 08, 2014 2:26 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Sling Auth Modules
>
> Hi,
>
> in order to get Launchpad 7 out, this is a vote to release
>
> Auth Core 1
+1
Best regards
mike
> -Original Message-
> From: Robert Munteanu [mailto:romb...@apache.org]
> Sent: Tuesday, July 29, 2014 10:54 AM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling Parent version 20
>
> Hi,
>
> We solved 3 issues in this release:
> https://issues.apach
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Wednesday, July 23, 2014 9:22 AM
> To: dev@sling.apache.org
> Subject: Re: Launchpad 7 Release?
>
> I've updated the bundle list - it was pretty current. For three bundles we
> still have open issues before
>
> On Tue, 2014-07-22 at 15:30 +0200, Carsten Ziegeler wrote:
> >
> > Looking at the snapshot list of the builder project, I guess we could
> > just
> > release all of them and we're got with Sling 7 and then maybe have a
> > look
> > at how to change things after Sling 7?
>
> +1, I think it's i
+1
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Wednesday, July 02, 2014 1:51 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling Scripting JSP 2.1.2 and Apache Sling
> Scripting
> Java 2.0.8
>
> Hi,
>
> We solved
Hi
Just my 2 cents to it:
Why not defining a "featureflag-interface" which is internally implemented
with ResourceAccessGates. Personally I think ResourceAccessGates could do
the job but I can follow the fear, that such a mechanism mixing up with a
security mechanism could lead to bad design. So
+1
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Monday, May 26, 2014 4:38 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling Service User Mapper 1.0.2
>
> Hi,
>
> We solved 1 issue in this release:
> https://issue
+1
Best regards
mike
> -Original Message-
> From: Robert Munteanu [mailto:romb...@apache.org]
> Sent: Thursday, May 15, 2014 11:03 AM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling Servlet Archetype 1.0.2
>
> Hi,
>
> We solved 9 issues in this release:
> https://issues
+1
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Thursday, May 15, 2014 2:20 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling Scripting JSP 2.1.0 and Apache Sling
> Commons Compiler 2.2.0
>
> Hi,
>
> this vote i
+1
Best regards
mike
> -Original Message-
> From: Robert Munteanu [mailto:romb...@apache.org]
> Sent: Thursday, May 15, 2014 10:55 AM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling Bundle Archetype 1.0.2
>
> Hi,
>
> We solved 5 issues in this release:
> https://issues.
+1
Best regards
mike
> -Original Message-
> From: Chetan Mehrotra [mailto:chetan.mehro...@gmail.com]
> Sent: Thursday, May 15, 2014 11:38 AM
> To: dev
> Subject: [VOTE] Release Apache Sling Classloader Leak Detector 1.0.0
>
> Hi,
>
> This is to vote for the Apache Sling Classloader Leak
+1
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Monday, March 31, 2014 2:25 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling Resource Resolver 1.1.0
>
> Hi,
>
> We solved 17 issues in this release:
> https://iss
+1
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Thursday, March 27, 2014 1:04 PM
> To: dev@sling.apache.org
> Subject: Re: [VOTE] Release Apache Sling Parent POM 19
>
> Anyone else?
>
>
> 2014-03-24 14:33 GMT+01:00 Carsten Ziegele
+1
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Thursday, March 27, 2014 1:04 PM
> To: dev@sling.apache.org
> Subject: Re: [VOTE] Release Apache Sling Servlets Get 2.1.8
>
> Anyone else?
>
>
> 2014-03-24 20:26 GMT+01:00 Oliver Lie
+1
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Thursday, March 27, 2014 1:03 PM
> To: dev@sling.apache.org
> Subject: Re: [VOTE] Release Apache Sling Servlets Resolver 2.3.2
>
> Anyone else?
>
>
> 2014-03-24 20:26 GMT+01:00 Olive
+1
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Thursday, March 27, 2014 1:03 PM
> To: dev@sling.apache.org
> Subject: Re: [VOTE] Release Apache Sling Installer Factory Configuration
> 1.0.12
>
> Anyone else?
>
>
> 2014-03-24 10:
...snipsnap
>
> Ok, I see your point and yes, partially this is related to the name
> "DONTCARE". I'm fine with renaming it to CANTDECIDE and then implementing
> it the way you suggest :)
>
> Regards
> Carsten
Okay, created SLING-3462.
Best regards
mike
> From: Bertrand Delacretaz [mailto:bdelacre...@apache.org]
> Subject: Re: [RT] Make ResourceAccessSecurity always restrict access if
> installed and no ResourceAccessGate present
>
> Hi,
>
> On Tue, Mar 18, 2014 at 8:48 AM, Mike Müller wrote:
> >... Maybe it wou
> 2014-03-17 8:38 GMT-07:00 Mike Müller :
>
> > Hi
> >
> > I think this is insecure by design and not correct:
> > The problem is not, that we do grant access if no ResourceAccessGate is
> > registered for application context. The problem is, that we
Hi
I think this is insecure by design and not correct:
The problem is not, that we do grant access if no ResourceAccessGate is
registered for application context. The problem is, that we grant access
also if there is a ResourceAccessGate registered for application level but
does return GateResult.
#getReadableResource does this.
> But of course if this is not the case, then you're totally right and we need
> to
> change this.
>
> And I totally agree that provider and application context should behave
> similar.
>
> Regards
> Carsten
>
>
> 20
Hi
As I worked on SLING-3435 [1] and added some more tests I noticed that
Even if resourceaccesssecurity is installed as a bundle the two implementing
classes ApplicationResourceAccessSecurityImpl (for application context) and
ProviderResourceAccessSecurityImpl (for provider context) are only re
+1
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Tuesday, March 11, 2014 2:39 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling Engine 2.3.2
>
> Hi,
>
> this vote is about the release of
>
> Apache Sling Engine 2
+1
Checked sigantures
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Tuesday, February 18, 2014 1:40 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling Servlets Resolver 2.3.0
>
> Hi,
>
> this vote is about the rel
+1
Checked sigantures
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Tuesday, February 18, 2014 11:37 AM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling Resource Merger 1.0.0
>
> Hi,
>
> this vote is about the firs
+1
best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Tuesday, January 21, 2014 8:45 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Apache Sling Event 3.3.4
>
> Hi,
>
> I just discovery a regression bug in the eventing (SLING-3329). The
+1
best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Tuesday, January 21, 2014 2:57 AM
> To: dev@sling.apache.org
> Subject: [VOTE] Apache Sling API 2.5.0
>
> Hi,
>
> its finally time for a new API release, we didn't have one for a long
+1
best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Wednesday, January 15, 2014 5:15 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling Event 3.3.2
>
> Hi,
>
> its time for a new Sling event release.
>
>
> https://
+1
best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Wednesday, January 15, 2014 4:56 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling Installer Core 3.5.0
>
> Hi,
>
> its time for a new installer core release.
>
>
elacre...@apache.org]
> Sent: Wednesday, January 15, 2014 10:12 AM
> To: dev
> Subject: Re: Reconsidering when to apply resource access security
>
> Hi Mike,
>
> On Wed, Jan 15, 2014 at 10:02 AM, Mike Müller wrote:
> > ...I think if
> > someone like to use ResourceAcce
Although this seems to be another compromise, it has advantages to
the actual flag which must be set on every provider. Sorry to say it
again, but no configuration would be easier and logical. The writer
of the ResourceAccessGate can decide anyway on which Resource he
will apply rules or not. That
Hi
In the hope not to raise dust again...
ResourceAccessGate could really help to harden existing Sling applications
even if they use JCR only as backend. As mentioned many times before
ResourceAccessGate does not interfere or cancel other ACLs like these from
JCR and it is not a substitution of t
+1
That would be more consistent.
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Monday, January 13, 2014 2:24 PM
> To: dev@sling.apache.org
> Subject: Reconsidering when to apply resource access security
>
> Hi,
>
> after long discu
Here's my +1
Best regards
mike
> -Original Message-
> From: Felix Meschberger [mailto:fmesc...@adobe.com]
> Sent: Monday, December 16, 2013 10:48 AM
> To: dev@sling.apache.org
> Subject: Re: [VOTE] Release Apache Sling Web Console Security Provider 1.1.2
>
> Hi Carsten
>
> Am 16.12.201
Hi
I'm not sure if it is a good idea that a ResourceDecorator could
return null. IMHO it's not what someone would expect from a
Decorator. All the more that "decorator" is the name of a well known
pattern, which would never be a null object (only a null object could
be decorated but not vice ver
+1
best regards
mike
> -Original Message-
> From: Stefan Egli [mailto:e...@adobe.com]
> Sent: Wednesday, November 27, 2013 3:03 PM
> To: dev@sling.apache.org
> Subject: Re: [VOTE] Release Apache Sling discovery.impl 1.0.2
>
> Hi Ian,
>
> It should be there now.
>
> (It was 'in the pipel
+1
Best regards
mike
> -Original Message-
> From: Bertrand Delacretaz [mailto:bdelacre...@apache.org]
> Sent: Tuesday, November 19, 2013 5:28 PM
> To: dev
> Subject: [VOTE] Release Apache Sling org.apache.sling.commons.testing 2.0.16
>
> Hi,
>
> We solved 5 issues in this release:
>
> h
> On Thu, Nov 14, 2013 at 2:35 PM, Felix Meschberger
> wrote:
>
> > Hi
> >
> > Sure you can do it, but it (a) doesn’t match the idea of an access gate
> > (at least not in my little brain cells) and (b) it is not comprehensive
> > since the JCR Resource Provider does not leverage that. (b) is IMHO
To confirm what Dominik mentioned:
The existing ResourceAccessGate would allow to grant or deny access
to resources. IMHO there's no need to implement another interface or
hook to achieve what is requested in the perspective of granting or denying
access to resources based on feature flag. Just imp
A warm welcome to the Sling committer team!
Best regards
mike
> -Original Message-
> From: Bertrand Delacretaz [mailto:bdelacre...@apache.org]
> Sent: Thursday, October 31, 2013 9:41 AM
> To: dev
> Subject: [ANN] please welcome Chetan Mehrotra as a Sling committer!
>
> Hi,
>
> Based on
1+
sorry for being late...
best regards
Mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Monday, October 28, 2013 9:30 AM
> To: dev@sling.apache.org
> Subject: Re: [VOTE] Release Apache Sling Web Console Security Provider 1.1.0
>
> Anyone else?
>
+1
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Sunday, October 20, 2013 4:18 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling Health Check Core 1.0.6, Health Check
> JMX 1.0.6, and JMX Resource Provider 0.6.0
>
+1
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Sunday, October 20, 2013 4:16 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling Commons Scheduler 2.4.2, Commons Threads
> 3.2.0, and Evenint 3.3.0
>
> Hi,
>
> it'
+1, cool tools ;-)
Best regards
mike
> -Original Message-
> From: Bertrand Delacretaz [mailto:bdelacre...@apache.org]
> Sent: Thursday, September 26, 2013 5:39 PM
> To: dev
> Subject: [VOTE] Initial Release of the Apache Sling Health Check Tools
>
> Hi,
>
> This is a vote for the initial
+1
Best regards
mike
> -Original Message-
> From: Felix Meschberger [mailto:fmesc...@adobe.com]
> Sent: Wednesday, September 18, 2013 10:00 AM
> To: dev@sling.apache.org
> Subject: Re: [VOTE] Drop the time zone info from committers page
>
> +1
>
> Regards
> Felix
>
> Am 17.09.2013 um 19
+1 for releasing it as 1.0.0 as the API seems tob e pretty stable.
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Tuesday, September 17, 2013 4:04 PM
> To: dev@sling.apache.org
> Subject: Re: [DISCUSS] move healthcheck under bundles/e
> From: ianbos...@gmail.com [mailto:ianbos...@gmail.com] On Behalf Of Ian Boston
>
> Hi Mike,
> Thanks for the pointer.
>
> On 12 September 2013 14:58, Mike Müller wrote:
> > Hi
> >
> > The common way to solve such an access control for a provider like
> &
Hi
The common way to solve such an access control for a provider like
the Cassandra resource provider is the new ResourceAccessSecurity
service. This is implemented in the bundle resourceaccesssecurity
(at this time only read rights will be checked). All you have to do is to
implement the SPI Re
+1
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Tuesday, September 03, 2013 8:20 AM
> To: dev@sling.apache.org
> Subject: [VOTE] Parent POM 18
>
> Hi,
>
> please vote for a release of our parent pom, it basically contains updates
>
+1
best regards
mike
> -Original Message-
> From: Felix Meschberger [mailto:fmesc...@adobe.com]
> Sent: Monday, August 26, 2013 10:11 AM
> To: dev@sling.apache.org
> Subject: [VOTE] Apache Commons Log 3.0.2
>
> Hi
>
> This is to vote for the Apache Commons Log 3.0.2 release. This is prob
+1
best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Friday, August 09, 2013 9:52 AM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Discovery Modules, Settings and Eventing
>
> Hi,
>
> this vote is primarily about doing the first
+1
best regards
mike
> -Original Message-
> From: Felix Meschberger [mailto:fmesc...@adobe.com]
> Sent: Monday, August 05, 2013 2:47 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling JCR Jackrabbit Server 2.1.2
>
> Hi,
>
> This vote is to release the Apache Sling JCR J
+1
best regards
mike
> -Original Message-
> From: Bertrand Delacretaz [mailto:bdelacre...@apache.org]
> Sent: Friday, May 24, 2013 12:06 PM
> To: dev
> Subject: [VOTE] release org.apache.sling.auth.form version 1.0.4
>
> Hi,
>
> We solved 3 issues in this release:
> https://issues.apache
+1
best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Friday, May 03, 2013 12:51 PM
> To: dev@sling.apache.org
> Subject: [VOTE] JCR Resource 2.2.8 and Servlets Post 2.3.0
>
> Hi,
>
> we have some important bug fixes and improvements to
+1
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Tuesday, April 30, 2013 10:16 AM
> To: dev@sling.apache.org
> Subject: [VOTE] Release API 2.4.2
>
> Hi,
>
> I just fixed two errors in ResourceUtil (SLING-2844 and SLING-2845) which
>
+1
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Tuesday, April 30, 2013 11:58 AM
> To: dev@sling.apache.org
> Subject: [VOTE] Release parent 16
>
> Please vote for the release of a new parent pom. This contains a single
> change, th
+1
best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Tuesday, April 23, 2013 1:02 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling Tenant 1.0.0 and Apache Sling
> javax.activation 0.1.0
>
> Hi,
>
> this vote is about
Welcome and congrats Dan!
best regards
mike
> -Original Message-
> From: Bertrand Delacretaz [mailto:bdelacre...@apache.org]
> Sent: Tuesday, April 23, 2013 10:03 AM
> To: dev
> Subject: [ANN] Please welcome Dan Klco as a Sling committer
>
> Hi,
>
> Based on his ongoing and valuable con
Welcome and congrats Stefan!
best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Tuesday, April 23, 2013 8:57 AM
> To: dev@sling.apache.org
> Subject: [ANN] New Committer : Stefan Egli
>
> The Project Management Committee (PMC) for Apache
+1
best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Monday, April 22, 2013 10:14 AM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Apache Sling Security 1.0.4
>
> Hi,
>
> this vote is about a fix in the security module (SLING-283
+1
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Thursday, April 18, 2013 8:14 AM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Testing ResourceResolver Mock 0.1.0
>
> Hi,
>
> this vote is about a first release of our new Tes
+1
To achieve that, it would be good, if there would be some
documentation available how testing stuff (especially integration
tests) should be done in the Sling project.
best regards
Mike
> -Original Message-
> From: Bertrand Delacretaz [mailto:bdelacre...@apache.org]
> Sent: Friday, Ap
, 2013 10:05 AM
> To: dev@sling.apache.org
> Subject: Re: Feedback on the current ResourceAccessSecurity API
>
> Hi Mike,
>
> On Wed, Apr 3, 2013 at 9:18 PM, Mike Müller wrote:
> > ...I commited a last shot of the SPI API. The Sling API hasn't changed
> > anymor
I commited a last shot of the SPI API. The Sling API hasn't changed
anymore. I think the API is now complete and after all the discussions
enough mature.
best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Wednesday, April 03, 2013 1:48 P
+1
> -Original Message-
> From: Bertrand Delacretaz [mailto:bdelacre...@apache.org]
> Sent: Wednesday, March 27, 2013 5:53 PM
> To: dev@sling.apache.org
> Subject: Re: Feedback on the current ResourceAccessSecurity API
>
> On Wed, Mar 27, 2013 at 5:48 PM, Carsten Ziegeler
> wrote:
> > ..
>
> So it is optimizeQuery really ;-)
>
> -Bertrand
optimizeQuery in matters of performant security checks :-)
Maybe you are right in this case, that we rather should name the method
optimizeQuery than sanitizeQuery.
mike
> > It's not really an optimization in the sense of a QueryOptimizer, that
> > could be
> done
> > by every ResourceProvider by now, without any new API. The sanitizeQuery
> functionality
> > has to come with the ResourceAccessSecurity service: The query can be
> injected
> > (sanitized) only from
> On Mon, Mar 25, 2013 at 8:14 PM, Mike Müller wrote:
> ...
> > Bertrand wrote:
> >> // Calling that canRead would be more consistent with other names
> >> public Resource checkReadPermission( Resource resource );
> >
> > I choosed another naming
> Notes on ResourceAccessSecurity:
>
> 1) javadocs says "* - Expected to only be implemented once in the
> framework/application...", I'm not sure about that. If you have both a
> filesystem and an HBase resource providers, they might use very
> different implementations?
>
> 2) Notes as comments
> From: Alexander Klimetschek [mailto:aklim...@adobe.com]
> On 25.03.2013, at 14:05, Carsten Ziegeler wrote:
>
> > 2013/3/25 Alexander Klimetschek :
> >>
> >> The crucial difference IMHO is that the sling API is meant for
> >> applications. The
> resource access security is a sling internal and
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Sunday, March 24, 2013 2:10 PM
> To: dev@sling.apache.org
> Subject: Re: [RT] ResourceAccessSecurity service for ResourceProvider without
> ACLs
>
> 2013/3/24 Mike Müller :
&g
From: Carsten Ziegeler [mailto:cziege...@apache.org]
> This sounds like an interesting idea - what would it need in the
> resource resolver bundle to support this property?
Not that much. The resource resolver bundle would route calls for
a resource provider with the new property set, through the
Hi
I'm coming up with a new thread concerning the use of the new
ResourceAccessSecurity service in implementations of ResourceProvider
which do not have uderlaying ACLs.
My first thought was that each ResourceProvider without any ACLs should
implement some lightweight access security through the
Hi
To be sure (and save some time coding ;-) ), I sum up our discussion:
We can keep the basic singleton service (ResourceAccessSecurity) in the API
and document it like this:
* Expected to only be implemented once in the framework/application
(much like the OSGi LogService or Configurati
> From: Felix Meschberger [mailto:fmesc...@adobe.com]
> > Okay, as far as I understand we've got the consensus of separating my
> > access gate
> > proposal from the Sling API. We should have something like a
> ResourceAccessSecurity
> > service in a extension bundle,
>
> I think we can keep the
Hi
Okay, as far as I understand we've got the consensus of separating my access
gate
proposal from the Sling API. We should have something like a
ResourceAccessSecurity
service in a extension bundle, I think we don't loose the goal of bringing Sling
forward to a frontend of resources from differ
> Sorry for asking a stupid question, but why would a ResourceProvider
> that delivered resources subject to security, not implement it that
> security and cover the use cases required as a part of its
> implementation ?
>
> 1 Allowing insecure ResourceProviders to exist with the intention of
> d
> 2013/3/6 Mike Müller :
> >> Just to throw in some more ideas :) what about a decorator for
> >> resource providers? This would also solve the use case of easily
> >> adding additional checks to resource providers who don't have their
> >> own access ch
> On Wed, Mar 6, 2013 at 4:32 PM, Mike Müller wrote:
> > ...A ResourceProviderDecorator couldn't do the job, because some operations
> > are on the ResourceResolver at the moment (delete, create but also
> > findResources
> > and queryResources)
>
> Do
> Many modern stores do not provide any security, they're just "stupid"
> key-value or column stores.
>
> How about being able to promote Sling + HBase as a scalable web
> framework, for example? How about Sling as web layer for Solr?
>
> That would be very cool IMO, and if you want ACLs in such
> Just to throw in some more ideas :) what about a decorator for
> resource providers? This would also solve the use case of easily
> adding additional checks to resource providers who don't have their
> own access checks without needing to code this into each and every
> provider.
>
> And a Reso
There are to main arguments which are repeatedly mentioned:
First we should not duplicate ACLs in a Sling layer and the second
that users of Sling can misunderstand the new service or abuse it.
For the first argument: One thing which was never taken in account
is that Sling is not only a frontend
+1
best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Wednesday, February 27, 2013 11:28 AM
> To: dev@sling.apache.org
> Subject: [VOTE] Apache Sling Launchpad Base 2.5.0 and Apache Sling Scripting
> Console 1.0.0
>
> Hi,
>
> this vote i
+1
Best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Thursday, January 31, 2013 5:48 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Drop Java 5 Support in General
>
> Hi,
>
> we see more and more problems with supporting Java 5 and we
+1
best regards
Mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Saturday, December 15, 2012 4:16 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Five New Releases
>
> Hi,
>
> This vote is about five new releases
>
> Parent 14
> https://issues.apa
+1
best regards
mike
> -Original Message-
> From: Felix Meschberger [mailto:fmesc...@adobe.com]
> Sent: Wednesday, December 05, 2012 3:17 PM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Sling Servlet Resolver 2.2.2
>
> Hi
>
> I would like to call a vote on the Sling Servlet Resol
+1
best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Friday, November 16, 2012 9:32 AM
> To: dev@sling.apache.org
> Subject: [VOTE] Release Commons OSGi, Settings, Rewriter, Launchpad Installer
> and Maven Launchpad Plugin
>
> Hi,
>
> T
+1
proved the signatures...
best regards
mike
> -Original Message-
> From: Carsten Ziegeler [mailto:cziege...@apache.org]
> Sent: Monday, November 12, 2012 11:27 AM
> To: dev@sling.apache.org
> Subject: [VOTE] New API and related bundles
>
> Hi,
>
> This vote is about ten modules in to
;
> Regards
> Carsten
thanks Carsten, looked at the wrong thing... ;-)
best regards
mike
> 2012/11/2 Mike Müller :
> >> I haven't followed all the changes, but so far the installer did
> >> inline the classes from OSGi commons. Maybe this new class needs to be
1 - 100 of 269 matches
Mail list logo
