[TYPO3-team-core-v5] Configuration switch for enabling / disabling security

Thu Dec 11 16:44:34 CET 2008

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hi Robert,

> your recent commit r1604 which contains the security switch is a quick
> solution to disable security but - as you agreed - not the final
> solution. Maybe I'll have to come up with the custom factories /
> constructor arguments for injected objects feature (#2109 + #2110)
> before we can further separate security from the rest of FLOW3 (the
> Dispatcher in particular).

exactly, for now it only disables the function calls to the security framework, not the dependencies. I'm not sure, if custom factories can change that at all. Maybe I didn't understand that, but if I have a custom security factory, the factory is again a dependency to the security package. As soon as we use DI with type hints or create objects of another package, we create a dependency. I don't see a solution for that problem right now. Of course we only create dependencies to interfaces, which is quite flexible, but we create dependencies. That again means we cannot leave the dependant interfaces of the security package away, as this will break on PHP level.

> The goal should be that there's no actual security code in the MVC
> framework. Instead we should use some pre / post processing mechanism
> or other hooks for invoking the security mechanisms.

What exactly is that about ?! Perhaps we could trigger an event in the dispatcher, and the security framework just registers an event handler, was that your idea?! With that we could completely decouple all classes and interfaces, because we just call a generic event handler. But a good event framework is far from beeing final in FLOW3, eh?

What do you think? Any other ideas in mind?

Greets Andi
Andreas Förthner
TYPO3 Research & Development

Telefon: +49 (911) 539909 - 0
E-Mail: andreas.foerthner at netlogix.de

- --
netlogix GmbH & Co. KG
Systemhaus | Trainingscenter | Medienagentur
Andernacher Straße 53 | 90411 Nürnberg
Telefon: +49 (911) 539909 - 0 | Fax: +49 (911) 539909 - 99
E-Mail: mailto:info at netlogix.de | Internet: http://www.netlogix.de/

netlogix GmbH & Co. KG ist eingetragen am Amtsgericht Nürnberg (HRA 13338).
Persönlich haftende Gesellschafterin: netlogix Verwaltungs GmbH (HRB 20634)
Geschäftsführer: Stefan Buchta, Matthias Schmidt, Guido-Arndt Söldner, Jens-Henrik Söldner