Page Comparison

https://docs.google.com/document/d/104vSgLvfi5zyQk3PT0S3z-9KnO-9pAwdxHne_CnLHTQ/edit#

For PC review, new module that corrects security defect in mod-config with a new module called mod-settings.
Mod-cofig stores permissions for apps, ex: in LDP, stores connection details for databases, in Users, stores list of users who are special and cannot be edited (admins.)
Security flaw - only 2 permissions read/write, applies and they apply to all modules , – if you can write to one, you can write to them all.

TC discussed TCR-24 yesterday and Ingolf and Jeremy said they would will do the technical review,

Initiative in TC to fix with a distributed config, but a lot of duplication of effort and potential confusion due to overlap
Easier way to fix Fixes the security flaw is to implement by implementing a separate module rather than adjust fixing the existing module(s) and ; will also use a more modern framework
Mod Settings, deprecate mod . Deprecate mod-config eventually
Setting consists of an identifier, scope name of module or more specific, read some write others, sep scope
.
Admins can change other users settings and their own.
3 permissions for each scope -- read, write, delete, much smaller module . Can now read some, write others, etc.

For other dev teams to use this – , there will be a migration guide to move off of mod-config onto mod-settings, but doing that is so not required. Define permissions, change paths, handle new error states that didn’t exist before.

PC members will look at the above document and . Kristen posted to the PC channel and Mike and Charlotte can answer questions there. Take a A formal vote will take place next week on whether to include in the Orchid release.