jimi icon indicating copy to clipboard operation
jimi copied to clipboard

Published 20 hours ago • verified publisher icon z1pti3

JIMI Core System - Inherited ACL from Trigger

Open b1scuit-thi3f opened this issue 4 years ago • 2 comments

Is your feature request related to a problem? Please describe. Flow should inherit ACL from the initial trigger. This would stop users who can create flows from escalating their privilege to the JIMI users (as JIMI runs everything in core as himself)

b1scuit-thi3f avatar Nov 24 '20 14:11 b1scuit-thi3f

Will look into this, but think that the ACL on objects is used to ensure this is the case as child objects will have inherited ACL from the object that created them.

z1pti3 avatar Nov 28 '20 12:11 z1pti3

Agreed that this should be added in version 3.0 to enable sandboxing of jimiFlows to prevent core escalation / breakout from user defined ACL.

Currently ACL is only enforced for web and core runs with access to all objects, this feature could enable core to run with limited ACL as per the ACL of the trigger object.

z1pti3 avatar Jan 03 '21 19:01 z1pti3