Merge pull request #9050 from gem/default-acl_on

Do not allow all users to see other users outputs by default
gem · Sep 28, 2023 · 21be65a · 21be65a
2 parents 41cb4b8 + 1fb92fa
commit 21be65a
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/debian/changelog b/debian/changelog
@@ -1,3 +1,7 @@
+  [Paolo Tormene]
+  * In the WebUI users are not allowed to see other users outputs by default
+    (the old default can be obtained setting ACL_ON = False)
+
   [Manuela Villani, Michele Simionato]
   * Computed ASCE-41 outputs for AELO project
 

diff --git a/openquake/server/settings.py b/openquake/server/settings.py
@@ -111,8 +111,8 @@
 
 # Authentication is not enabled by default
 LOCKDOWN = False
-# Allow all users to see other users outputs by default
-ACL_ON = False
+# Forbid users to see other users outputs by default
+ACL_ON = True
 
 # Add additional paths (as regular expressions) that don't require
 # authentication.