[Sugar-devel] HTML activities
dwnarvaez at gmail.com
Tue Jan 29 09:11:57 EST 2013
On 29 January 2013 14:52, Gonzalo Odiard <gonzalo at laptop.org> wrote:
>> I added as well an example for dbus methods, you can delete DS entries now
>> :) http://dev.laptop.org/~erikos/html-activity/
> And can be accessed by http and scripted? This is a good example of one
> thing we don't want happen accidentally, right?
> Script kiddies removing the datastore content?
You cannot access localhost from js provided by a remote page, if
that's what you are worried about. I don't remember if we have any
limitation in place right now about doing it from another activity. I
guess not but probably we should :)
We do need to think carefully about the security implications of all of this.
More information about the Sugar-devel