Re: Fun with WebAda/GNAT

[dsmith@clark.net (Doug Smith)]

In article <32181E12.7427@lmtas.lmco.com>, Ken Garlington
<garlingtonke@lmtas.lmco.com> wrote:
> [snip]
> 
> By the way, Doug Smith says:
> 
> > The delete unit operation will be available soon. It is not as
> > straightforward as it sounds to have a clean interface using forms and
> > cgi scripts and to maintain some level of protection from accidentally
> > deleting someone else's file (or a predefined package specification!).
> 
> I'm not sure I see the difficulty. Currently, WebAda only shows me my files
> on the file list. I can't edit other people's files, or pre-defined packages,
> from that list. Just add a Delete button next to the Edit button on the file
> list.

Ohhh, but you can see other people's files. And you can surf the units
which gives you an edit button. Try this:
 
<http://sw-eng.falls-church.va.us/cgi-bin/webada/surfada?file=/export/user_data/ada_source/dsmith.clark.net/sort.adb>

You are surfing some code in my WebAda directory. Notice the edit button!
Guess what happens.....drum roll.....you get a copy in your own directory
to edit. You'll have to "edit" the spec also to get your copy to compile.

Now consider what happens when I add the delete cgi-bin script. You could
type in a URL by hand, such as the one above, and substitute "delete" for
"surfada". I have to make sure you don't delete my file.

By the way, you can surf the predefined packages and edit them...well at
least a copy which goes into your own directory. All the more reason to
have a delete operation!

And, of course, I plan (and have already started) to add a library
(i.e. directory) search path ability to WebAda. Which will allow clients
to more easily share their code...again, I don't want anyone to delete
units that aren't theirs.

No unix permissions don't help here because everyone going through the http
server has the same permissions.

Well, I've talked this one to death. I need to work on the problem instead
of talking about it!

Doug.