From e75af0b19ef50ff9d5c5398c158e6e792240141a Mon Sep 17 00:00:00 2001 From: Arne Hassel Date: Mon, 19 Aug 2019 19:47:46 +0200 Subject: [PATCH 1/4] Prevent users from deleting their root ACLs This checks whether pathname indicates that the target is root, or whether the root ACL itself states that the target is root. --- src/acl-control.js | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/acl-control.js b/src/acl-control.js index aeff186c3..1b2833914 100644 --- a/src/acl-control.js +++ b/src/acl-control.js @@ -612,14 +612,17 @@ UI.aclControl.ACLControlBox5 = function (subject, dom, noun, kb, callback) { var q = str.indexOf('//') var targetDocDir = ((q >= 0 && p < q + 2) || p < 0) ? null : str.slice(0, p + 1) - if (targetDocDir) { + // eslint-disable-next-line no-undef + const targetIsStorage = kb.holds(targetDoc, UI.ns.rdf('type'), UI.ns.space('Storage'), targetACLDoc) || (location && location.pathname === '/') + + if (!targetIsStorage && targetDocDir) { UI.acl.getACLorDefault($rdf.sym(targetDocDir), function (ok2, p22, targetDoc2, targetACLDoc2, defaultHolder2, defaultACLDoc2) { if (ok2) { prospectiveDefaultHolder = p22 ? targetDoc2 : defaultHolder2 } addDefaultButton(prospectiveDefaultHolder) }) - } else { + } else if (!targetIsStorage) { addDefaultButton() } From 1bf064788932c462acc31817e4bd1ed98f3d6d7a Mon Sep 17 00:00:00 2001 From: Arne Hassel Date: Mon, 19 Aug 2019 20:49:10 +0200 Subject: [PATCH 2/4] Adding comment about the part that is hacky --- src/acl-control.js | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/acl-control.js b/src/acl-control.js index 1b2833914..a3a3e01d0 100644 --- a/src/acl-control.js +++ b/src/acl-control.js @@ -612,6 +612,8 @@ UI.aclControl.ACLControlBox5 = function (subject, dom, noun, kb, callback) { var q = str.indexOf('//') var targetDocDir = ((q >= 0 && p < q + 2) || p < 0) ? null : str.slice(0, p + 1) + // @@ TODO: The methods used for targetIsStorage are HACKs - it should not be relied upon, and work is + // @@ underway to standardize a behavior that does not rely upon this hack // eslint-disable-next-line no-undef const targetIsStorage = kb.holds(targetDoc, UI.ns.rdf('type'), UI.ns.space('Storage'), targetACLDoc) || (location && location.pathname === '/') From af8cd6010198c4ceea1f760828a700bb5a584c07 Mon Sep 17 00:00:00 2001 From: Arne Hassel Date: Thu, 22 Aug 2019 15:13:20 +0200 Subject: [PATCH 3/4] Added URL that might fix hack and remove eslint-disable-next-line Based on some feedback from Vincent --- src/acl-control.js | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/acl-control.js b/src/acl-control.js index a3a3e01d0..9d65ec27d 100644 --- a/src/acl-control.js +++ b/src/acl-control.js @@ -614,8 +614,9 @@ UI.aclControl.ACLControlBox5 = function (subject, dom, noun, kb, callback) { // @@ TODO: The methods used for targetIsStorage are HACKs - it should not be relied upon, and work is // @@ underway to standardize a behavior that does not rely upon this hack - // eslint-disable-next-line no-undef - const targetIsStorage = kb.holds(targetDoc, UI.ns.rdf('type'), UI.ns.space('Storage'), targetACLDoc) || (location && location.pathname === '/') + // @@ hopefully fixed as part of https://github.com/solid/data-interoperability-panel/issues/10 + const targetIsStorage = kb.holds(targetDoc, UI.ns.rdf('type'), UI.ns.space('Storage'), targetACLDoc) || + (window.location && window.location.pathname === '/') if (!targetIsStorage && targetDocDir) { UI.acl.getACLorDefault($rdf.sym(targetDocDir), function (ok2, p22, targetDoc2, targetACLDoc2, defaultHolder2, defaultACLDoc2) { From d817ed9ed3d377d76f7f1a6ffca75f468f5b62d8 Mon Sep 17 00:00:00 2001 From: Arne Hassel Date: Tue, 27 Aug 2019 23:11:52 +0200 Subject: [PATCH 4/4] Writing out use of window.location Using suggested solution from Tim. Also made code a bit more verbose, to make it easier to fix hacks when we have a standard way of handling this. --- src/acl-control.js | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/src/acl-control.js b/src/acl-control.js index 9d65ec27d..d130de072 100644 --- a/src/acl-control.js +++ b/src/acl-control.js @@ -615,17 +615,18 @@ UI.aclControl.ACLControlBox5 = function (subject, dom, noun, kb, callback) { // @@ TODO: The methods used for targetIsStorage are HACKs - it should not be relied upon, and work is // @@ underway to standardize a behavior that does not rely upon this hack // @@ hopefully fixed as part of https://github.com/solid/data-interoperability-panel/issues/10 - const targetIsStorage = kb.holds(targetDoc, UI.ns.rdf('type'), UI.ns.space('Storage'), targetACLDoc) || - (window.location && window.location.pathname === '/') + const targetIsStorage = kb.holds(targetDoc, UI.ns.rdf('type'), UI.ns.space('Storage'), targetACLDoc) + const targetAclIsProtected = hasProtectedAcl(targetDoc) + const targetIsProtected = targetIsStorage || targetAclIsProtected - if (!targetIsStorage && targetDocDir) { + if (!targetIsProtected && targetDocDir) { UI.acl.getACLorDefault($rdf.sym(targetDocDir), function (ok2, p22, targetDoc2, targetACLDoc2, defaultHolder2, defaultACLDoc2) { if (ok2) { prospectiveDefaultHolder = p22 ? targetDoc2 : defaultHolder2 } addDefaultButton(prospectiveDefaultHolder) }) - } else if (!targetIsStorage) { + } else if (!targetIsProtected) { addDefaultButton() } @@ -691,4 +692,10 @@ UI.aclControl.ACLControlBox5 = function (subject, dom, noun, kb, callback) { renderBox() return table } // ACLControlBox + +function hasProtectedAcl (targetDoc) { + // @@ TODO: This is hacky way of knowing whether or not a certain ACL file can be removed + // Hopefully we'll find a better, standardized solution to this - https://github.com/solid/specification/issues/37 + return targetDoc.uri === targetDoc.site().uri +} // ends