Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cross inheritance #18

Closed
jyotman opened this issue Sep 29, 2017 · 2 comments
Closed

Cross inheritance #18

jyotman opened this issue Sep 29, 2017 · 2 comments
Labels
revision A change rather than a bug or feature. security Issue breaks security.

Comments

@jyotman
Copy link

jyotman commented Sep 29, 2017

Should cross inheritance be allowed?

For example I have 2 roles - user and admin.

Now if I write -

ac.grant('admin').extend('user')
ac.grant('user').extend('admin')

Then from this moment onward, both the roles have become exactly similar. All the permissions given to admin role would apply to user role and vice-versa. Then what's the point of having 2 different roles?

Forgive if I'm missing something. And thanks for this really useful module.

@onury
Copy link
Owner

onury commented Oct 3, 2017

Although, there's no point doing that; it's still valid (currently).

But I see your concern. This might even lead to security issues on the host application, if not used with caution. Besides, I can't think of any true, valid use of cross-inheritance.

I'll consider this in the next version (will be released in a couple of days).
Thanks.

@onury onury added the revision A change rather than a bug or feature. label Oct 3, 2017
@onury
Copy link
Owner

onury commented Oct 5, 2017

Cross-role inheritance is no more allowed in v2.0.0+

@onury onury closed this as completed Oct 5, 2017
@onury onury added the security Issue breaks security. label Nov 14, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
revision A change rather than a bug or feature. security Issue breaks security.
Projects
None yet
Development

No branches or pull requests

2 participants