Revealing user ID & security

Next topic

Author	Message
Piotrek Karaś	Tuesday 12 August 2008 7:29:08 am Hi all, Do you think revealing user ID (actual ID, not NodeID) in the forms or URLs could be potentially risky for any reason? Thanks, Piotrek -- Company: mediaSELF Sp. z o.o., http://www.mediaself.pl eZ references: http://ez.no/partners/worldwide_partners/mediaself eZ certified developer: http://ez.no/certification/verify/272585 eZ blog: http://ez.ryba.eu
Piotrek Karaś	Friday 15 August 2008 11:27:27 pm Or maybe another way: is revealing object ID risky at all? User ID is a content object ID after all... -- Company: mediaSELF Sp. z o.o., http://www.mediaself.pl eZ references: http://ez.no/partners/worldwide_partners/mediaself eZ certified developer: http://ez.no/certification/verify/272585 eZ blog: http://ez.ryba.eu
André R.	Sunday 17 August 2008 7:23:02 am Only if you use only visually block certain users from being able to do something with a object. (eg code in templates to decide on who should see edit / delete button based on something else then actually user rights) eZ Online Editor 5: http://projects.ez.no/ezoe \|\| eZJSCore (Ajax): http://projects.ez.no/ezjscore \|\| eZ Publish EE http://ez.no/eZPublish/eZ-Publish-Enterprise-Subscription @: http://twitter.com/andrerom
Piotrek Karaś	Sunday 17 August 2008 8:11:36 am Oh, yeah, but then it wouldn't be the best practice in any case, I suppose. I'm thinking of users' mutual contact book architecture, and wondering of using user IDs directly (rather than providing some id obfuscation) would be acceptable. If not, the only thing comes to my mind capable of handling this level of ID uniqueness would be some hash function on user ID. Thanks, Piotrek -- Company: mediaSELF Sp. z o.o., http://www.mediaself.pl eZ references: http://ez.no/partners/worldwide_partners/mediaself eZ certified developer: http://ez.no/certification/verify/272585 eZ blog: http://ez.ryba.eu

eZ debug

Timing:	Jan 18 2025 18:20:08
Script start
Timing:	Jan 18 2025 18:20:08
Module start 'layout'
Timing:	Jan 18 2025 18:20:08
Module start 'content'
Timing:	Jan 18 2025 18:20:09
Module end 'content'
Timing:	Jan 18 2025 18:20:09
Script end

Main resources:

Total runtime	1.3697 sec
Peak memory usage	4,096.0000 KB
Database Queries	60

Timing points:

Checkpoint	Start (sec)	Duration (sec)	Memory at start (KB)	Memory used (KB)
Script start	0.0000	0.0069	589.0469	152.6250
Module start 'layout'	0.0069	0.0040	741.6719	39.4453
Module start 'content'	0.0108	1.3574	781.1172	556.9922
Module end 'content'	1.3682	0.0014	1,338.1094	16.1641
Script end	1.3697		1,354.2734

Time accumulators:

Accumulator	Duration (sec)	Duration (%)	Count	Average (sec)
Ini load
Load cache	0.0031	0.2241	16	0.0002
Check MTime	0.0013	0.0928	16	0.0001
Mysql Total
Database connection	0.0014	0.1014	1	0.0014
Mysqli_queries	1.3183	96.2466	60	0.0220
Looping result	0.0005	0.0366	58	0.0000
Template Total	1.3366	97.6	2	0.6683
Template load	0.0022	0.1614	2	0.0011
Template processing	1.3344	97.4198	2	0.6672
Template load and register function	0.0001	0.0065	1	0.0001
states
state_id_array	0.0009	0.0692	1	0.0009
state_identifier_array	0.0026	0.1909	2	0.0013
Override
Cache load	0.0018	0.1295	20	0.0001
Sytem overhead
Fetch class attribute can translate value	0.0004	0.0317	2	0.0002
Fetch class attribute name	0.0012	0.0897	6	0.0002
XML
Image XML parsing	0.0008	0.0613	2	0.0004
class_abstraction
Instantiating content class attribute	0.0000	0.0012	8	0.0000
General
dbfile	0.0010	0.0744	24	0.0000
String conversion	0.0000	0.0007	4	0.0000
Note: percentages do not add up to 100% because some accumulators overlap

Templates used to render the page:

Usage	Requested template	Template	Template loaded
1	node/view/full.tpl	full/forum_topic.tpl	extension/sevenx/design/simple/override/templates/full/forum_topic.tpl
4	content/datatype/view/ezimage.tpl	<No override>	extension/sevenx/design/simple/templates/content/datatype/view/ezimage.tpl
4	content/datatype/view/ezxmltext.tpl	<No override>	extension/community_design/design/suncana/templates/content/datatype/view/ezxmltext.tpl
6	content/datatype/view/ezxmltags/paragraph.tpl	<No override>	extension/ezwebin/design/ezwebin/templates/content/datatype/view/ezxmltags/paragraph.tpl
2	content/datatype/view/ezxmltags/line.tpl	<No override>	design/standard/templates/content/datatype/view/ezxmltags/line.tpl
1	print_pagelayout.tpl	<No override>	extension/community/design/community/templates/print_pagelayout.tpl
Number of times templates used: 18 Number of unique templates used: 6

Time used to render debug report: 0.0001 secs