TryGhost/Ghost — pull request #2701 by jgable (2014-05-07 01:00:25+00:00)
Title: ACL and strict rules for Settings API

Ref #2061

- Add canThis permission checks to settings api calls
- Add strict rules about accessing core settings without internal: true
- Omit core settings in browse() call unless internal: true
- Update unit tests to call api.settings with contexts
- Add a couple unit tests for new scenarios
- Update all api.settings calls in the app to call with internal context
- Re-arrange permissions.init in server startup so config.theme.update
can access settings without permissions error

I didn't have time to get to the validation that only settings from defaultSettings.json should be added, or the lazy loading either. But, this is a good portion of the canThis integration for #2061.