<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
</style>
</head>
<body class='hmmessage'>
Security checks should always be carried out by the class that govern the objects that is accessed, it can in turn delegate this to something like a policy (permissions) manager.<BR>
<BR>
So, what I'm saying is, +1 on moving this out of the 'outer perimeter' that is clientview.<BR>
<BR>
---<BR>
<BR>
I realise when we only have one ClientView, it doesn’t matter too much where those checks occur – however when we add multiple client views into the system, we’re potentially in a situation where there could be different security permissions depending on which client you connect with.<BR>
<DIV class=EC_Section1>
<P class=EC_MsoNormal> </P>
<P class=EC_MsoNormal>I would like to propose that as a standard, we handle ‘Can a user do this’ in the appropriate module rather than in the Client Stack. IE – doing ‘can a user terraform here?’ inside the Terrain module instead of ‘RecieveTerraformPacket’.</P>
<P class=EC_MsoNormal> </P>
<P class=EC_MsoNormal>Adam</P></DIV></body>
</html>