Hi Arkadiusz,
On Mon, Oct 28, 2024 at 4:33 PM Arkadiusz Bokowy
<arkadiusz.bokowy@xxxxxxxxx> wrote:
>
> > > +static void set_delay_report(const GDBusPropertyTable *property,
> > > + DBusMessageIter *iter, GDBusPendingPropertySet id,
> > > + void *data)
> > > +{
> > > + struct media_transport *transport = data;
> > > + uint16_t arg;
> > > + int err;
> >
> > This really needs to check that sender is the owner of the transport.
>
> The problem is that currently there is no mechanism which will allow
> to get the sender name in the property get/set callback (at least I
> couldn't find any). The statement "this property is only writable when
> the transport was acquired by the sender" is also for the Volume
> property, but as for Delay (which currently lacks the setter) it's not
> implemented. So, now the question is whether you would like to fix
> that as well (or amend the doc)? Some users might say that allowing
> others to control volume might be a feature. For the Delay I'm not
> sure... Probably you are right that the Delay is more intrinsic to the
> transport, and external manipulation would not be desired.
>
> As for the design of this authorization check I can see two possibilities:
>
> 1. Pass `message` to the `property->set()` in the
> "dbus/objects.c:properties_set()". But this will require updates in
> all setters (and maybe for symmetry the getter should also receive the
> original message?).
> 2. Add a dedicated callback for setter/getter authorization, in a
> similar way the `exists()` works.
>
> In either way I think that this should be a separate patch, applied
> either before or after the Delay work.
Right, or we could just implement something like get_sender_by_id then
the callback can just call it to check who is the sender, that way we
don't need to modify existing code if it doesn't care about it.
> Regards,
> Arek
--
Luiz Augusto von Dentz
