Makes sense, thanks Ox!


On Sat, Oct 26, 2013 at 11:39 AM, oxtoacart <notifications@github.com>wrote:

> In src/main/java/org/lantern/admin/rest/InvitesResource.java:
>
> > +import org.lantern.data.PMF;
> > +
> > +@Path("/invites")
> > +@JsonIgnoreProperties(ignoreUnknown = true)
> > +public class InvitesResource {
> > +    @GET
> > +    @Path("/pending")
> > +    @Produces(MediaType.APPLICATION_JSON)
> > +    public Collection<InviteWithUsers> query(@QueryParam("where") String where,
> > +            @QueryParam("ordering") String ordering) {
> > +        try {
> > +            final PersistenceManager mgr = PMF.get().getPersistenceManager();
> > +            final Query query = mgr.newQuery(Invite.class);
> > +            String filter = "status == 'queued'";
> > +            if (!StringUtils.isBlank(where)) {
> > +                filter = String.format("%1$s && %2$s", filter, where);
>
> It's not a problem because we're not sending in an entire query, we're
> just setting the filter clause.
>
> Also, admins already have access to the datastore viewer where they can do
> much more damage if they want, not to mention managing app deployment.
>
> I think what may be called for is a new role.
>
> See new bug getlantern/lantern#1080<https://github.com/getlantern/lantern/issues/1080>
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/getlantern/lantern-controller/pull/46/files#r7234120>
> .
>