[geeklog-devel] [geeklog-cvs] Geeklog-1.x/system lib-admin.php, 1.127, 1.128 lib-security.php, 1.62, 1.63

[Michael Jervis]

>  Security Tokens are a great idea. But I think this needs some

>  discussion before being considered complete.


You only have part of the picture.


>  SEC_createToken($page, $ttl);


TTL may become an argument.


>  Make the caller responsible for uniquely naming what page he's on.

>  Maybe the page the token is created on isn't the same page the token

>  is processed on?


Read the rest of the commit. Run it. Understand it. Then comment.


>  Likewise, what is this TTL mapping stuff? Make the caller responsible

>  for saying "My page can sit on your browser for no longer than 5

>  minutes." Mappings are unfriendly to plugins, too.


TTL not yet implemented or fully figured out. Work in progress.