You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
Flow should inherit ACL from the initial trigger. This would stop users who can create flows from escalating their privilege to the JIMI users (as JIMI runs everything in core as himself)
The text was updated successfully, but these errors were encountered:
Will look into this, but think that the ACL on objects is used to ensure this is the case as child objects will have inherited ACL from the object that created them.
Agreed that this should be added in version 3.0 to enable sandboxing of jimiFlows to prevent core escalation / breakout from user defined ACL.
Currently ACL is only enforced for web and core runs with access to all objects, this feature could enable core to run with limited ACL as per the ACL of the trigger object.
Is your feature request related to a problem? Please describe.
Flow should inherit ACL from the initial trigger. This would stop users who can create flows from escalating their privilege to the JIMI users (as JIMI runs everything in core as himself)
The text was updated successfully, but these errors were encountered: