Improving the editor: business logic for permissions

[MisterMooCow]

Anyone looked into this?

Modifications are verified server side, and have been ever since Papyrus was been around in 2009, that's why you get save errors.

Then why was it possible to circumvent that in cartouche_old?

[MisterMooCow]

Has there been a major change to the API that the editors use (with the demise of cartouche_old)?

I'm really annoyed at no longer being able to "work around" permission issues by using cartouche_old, so I'm contemplating a deep-dive into the WME javascript to come up with another workaround. Assuming they're still implementing the permissions business logic in the editor (and allowing essentially a free-for-all at the raw web services interface), it should be possible to come up with a more intelligent permissions mechanism using an extension.

Anyone looked into this?

On the other hand, I'm just about to cross 200K edits-- is that still the threshold for loosening the shackles?

[Kuhlkatz]

Then why was it possible to circumvent that in cartouche_old?

Maybe the different URLs should provide a hint that they likely made use of different Web server back end interfaces.

I thought the whole idea of the level locks were to STOP editors from changing whatever they shouldn't.
I'm not expecting you to get much traction here or much help from Waze to try and circumvent their locking mechanism.

[bgodette]

Then why was it possible to circumvent that in cartouche_old?

Because it was a different backend.

[bgodette]

Anyone looked into this?

Modifications are verified server side, and have been ever since Papyrus was been around in 2009, that's why you get save errors.

[AlanOfTheBerg]

Then why was it possible to circumvent that in cartouche_old?

Because it was a different backend.

And whether the code which is doing different permissions checking now is part of something in the webserver or within the database, we don't know and it doesn't really matter. Permissions are taken care of server side and there's little we could do from the browser side except make things more restrictive. Which, ultimately, could be easily circumvented with userscripts.