sebbacon/alaveteli — Issue #427: Be more careful about who gets "authority" privileges
Author: hsenag
Created: 2012-02-14 06:40:42+00:00
State: open

Currently anyone with an email address @ the same domain as the FOI address can do special things on behalf of the authority. This goes wrong for small councils that use personal email accounts instead of having their own domain - e.g. anyone @gmail.com could upload to some councils.

This will also become more of a risk if and when we open up more features to the authority.

A few ideas for fixing this
- don't apply the logic to .com addresses
- have a blacklist somewhere of domains the logic doesn't apply to
- add a field to the authority page for specifying the domain to accept with "[none]" or similar to disable, and default to the current logic and/or some of the other proposals