diff options
| author | tv <tv@krebsco.de> | 2026-11-08 09:41:05 +0000 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-08 14:28:56 +0100 |
| commit | 4ecb4ee5c0a49fc6d78ae06e21f6bb1571e290cb (patch) | |
| tree | d7e6858f48b654070b2ffd7650c7b6313c290cdd /docs/remakes.md | |
| parent | b08c0bfd3ffcfd39ef2689882fafafbc31f16ffd (diff) | |
remake: replay from the quarantine where the user may write
POST /admin/quarantine/{id}/replay needs write on _continuum, which
never covers user data, and replayed every path of the entry as the
user who asked: every node refused the user data in it. It now
replays only the paths the user may write and keeps the rest in the
entry (left), for one who may; 403 if the user may write none.
Review finding 3 (quarantine replays).
Diffstat (limited to 'docs/remakes.md')
| -rw-r--r-- | docs/remakes.md | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/docs/remakes.md b/docs/remakes.md index cad429f..8e585c6 100644 --- a/docs/remakes.md +++ b/docs/remakes.md @@ -339,7 +339,9 @@ curl -X DELETE localhost:3000/admin/quarantine/<id> # discard ``` Replaying writes the values at their old paths as fresh writes (they win over what is -there now), in the name of the user who asked. Quarantine doesn't survive a restart of that node, so look at it soon; the +there now), in the name of the user who asked: only at the paths it may write, as every +node judges the change by them ([`access.md`](access.md)); the rest stay (`left`), for +one who may. Quarantine doesn't survive a restart of that node, so look at it soon; the remake report's `local.quarantine` on that node names the entry. ## Troubleshooting |