Subject: sieve/managesieve/time and ACL

From: Arnt Gulbrandsen <[email-masked]>
Date: Fri, 12 May 2006 16:33:40 +0200

Hi,

suppose I upload a script to the server using managesieve. A perfectly 
fine script which contain only a fileinto command for the mailbox 
/mumble/stumble. The next day, someone who doesn't like me changes the 
ACL on /mumble/stumble such that I no longer have the right to insert 
messages into it.

What should happen when a message arrives and the script wants to 
fileinto? I can't find any mention at all of access control in 3028bis, 
far less of access control which changes after the sieve is blessed by 
managesieve.

Arnt

---

From: Cyrus Daboo <[email-masked]>
Date: Fri, 12 May 2006 10:36:36 -0400

Hi Arnt,

> far less of access control which changes after the sieve is blessed by

If fileinto fails an implicit keep occurs - so it will end up in your INBOX.

-- 
Cyrus Daboo

---

From: Ned Freed <[email-masked]>
Date: Fri, 12 May 2006 07:57:53 -0700 (PDT)

> ACL on /mumble/stumble such that I no longer have the right to insert

The implication here is that you might want to check fileinto validity
in managesieve. I'm very dubious about this being a good idea - in addition
to ACLs changing after the fact, there's also the issue of uploading the
sieve referring to the mailbox before the mailbox is created.

I also suspect that in many architectures it would be quite difficult to
perform such a check. It certainly is next to impossible to do a meaningful
check of this sort in ours.

> far less of access control which changes after the sieve is blessed by

We handle this case essentially by converting the fileinto into a keep.
I don't thinking requiring such behavior is a good idea, however, we might
want to point out the issue and suggest this as one way to deal with it.

				Ned

---

From: Cyrus Daboo <[email-masked]>
Date: Fri, 12 May 2006 11:18:54 -0400

Hi Ned,

> want to point out the issue and suggest this as one way to deal with it.

That was better than simply treating the fileinto as a run time error and 
doing an implicit keep?

-- 
Cyrus Daboo

---

From: Ned Freed <[email-masked]>
Date: Fri, 12 May 2006 08:22:01 -0700 (PDT)

> That was better than simply treating the fileinto as a run time error and

Actually, yes, it is better, since the runtime error would prevent other
actions from being taken.

In any case, turning this into a runtime error is not an option since sieve
execution is completed long before any sort of check of mailbox validity is
possible.

				Ned