bugSELF Platform - Bugs: bug #22391, Anonymous users can't edit LOs

 
 

bug #22391: Anonymous users can't edit LOs

Submitted by:  Federico Heinz <fheinz>
Submitted on:  Fri 22 Feb 2008 06:06:23 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: In Progress
Privacy: PublicAssigned to: Bipin A. <bipina>
Open/Closed: Open

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 24 Mar 2008 02:47:32 PM UTC, comment #4:

As I mentioned to Dinesh, the IP address is not a good solution, it's just better than no solution. But you are right that a hash of the cookie may be a better solution yet.

As to having to upload the file in order to import it, is this just a temporary implementation detail, or a fundamental design decision?

I don't think it's the way most users would expect it to work, and it certainly isn't the easiest way. Importing a SCORM file should be a simple matter of sending it to the seerver for import in a single operation triggered by a single form. Otherwise, the process involves too many steps:

1) upload the file
2) import the uploaded file
3) delete the uploaded file

This is too complicated, uncalled for, and brings with it the problem that most users will likely forget to perform step 3, which will leave us with a server full of large SCORM objects we cannot delete.

I guess I should open another ticket for this one?

Federico Heinz <fheinz>
Sat 22 Mar 2008 03:42:54 PM UTC, comment #3:

if there are two or more people working behind a firewall, or using a proxy to obtain Internet, SELF Platform will see only a single IP. Cookies will be different even in this case.

Without uploading it is not possible to import a course, for import is done from a filemanager. This is what we have implemented in the selfApp.

Nagarjuna G. <nagarjun>
Project Administrator
Sat 22 Mar 2008 01:57:14 PM UTC, comment #2:

Would the wikipedia way of doing things (attributing the change to an IP) be too much trouble? I realize we don' t want to have a Plone user for each IP out there... I'm thinking along the lines of creating a single user called "anonymous", and to log the IP address together with the change.

CAPTCHAs for anonymous are a Good Idea, too.

On anonymous uploading: maybe a bad idea. If the file manager is related to a user anyway, it doesn't even make much sense to allow anonymous to upload stuff to an either non-existing or simply humongous pile of stuff. I guess anonymous SCORM import should be allowed.

Federico Heinz <fheinz>
Sat 22 Mar 2008 08:50:12 AM UTC, comment #1:

For this to happen, we need a set of users who are anonymous: should we add users anon1 anon2 etc. or should all users who are not logged in be considered a single user. In this case, each anon with a distinct cooky will be considered a different user. Same person from a different client will be considered different user.

In GNOWSYS no object/node can be added unless uid (user id) is provided.

Second precaution that we should also be ready for is to add a mechanism like captcha, to prevent non human beings to uplaod content and make changes.

BTW, should uploading files also should be allowed without authentication.

Consequences of a single user doing all anon stuff may become serious over a period of time. Their filemanager for example may have too much stuff.

What other motivating feature should we inform anonymous users, so that they are tempted to create accounts.

Nagarjuna G. <nagarjun>
Project Administrator
Fri 22 Feb 2008 06:06:23 PM UTC, original submission:

The system currently forbids anonymous users from editing LOs, but it shouldn't.

Federico Heinz <fheinz>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by nagarjun (Posted a comment)
  • -unavailable- added by fheinz (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 22 Mar 2008 08:51:47 AM UTCnagarjunStatusNone=>In Progress
    Sat 22 Mar 2008 08:50:12 AM UTCnagarjunAssigned toNone=>bipina

    Back to the top


    Powered by Savane 3.1-cleanup1