-
Notifications
You must be signed in to change notification settings - Fork 2
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update RBAC after each roleSetter
function event is received and it is executed successfully
#31
Comments
|
On second thoughts this would have been a deterimental vulnerability of the monitoring system if implemented like this. In simple words, any function could change the roles of an account without being noticed. This features should be changed to To resolve this correctly, we have to use another parameter as the monitor giving in the following form: Here, the |
roleSetter
function event is received
roleSetter
function event is receivedroleSetter
function event is received and it is executed successfully
The updating of RBAC using
updateRBAC
utility function should happen regardless of the violation or normal events. This will ensure the monitor is keeping track of the runtime data correctly.I think the following line is the suitable place to add it (before
serve
):https://github.com/mojtaba-eshghie/CLawK/blob/43d809942a90c2beb851579a473cba379ef42eac/server/monitor/dcrCaller.js#L65
The text was updated successfully, but these errors were encountered: