[ROL-2176] Document the security model

• Type: Wish
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Component/s: Website and Documentation
• Assignee: David M. Johnson
• Reporter: Arnout Engelen
• Created: 15/Nov/22 10:31
• Updated: 07/May/23 12:55
• Resolved: 07/May/23 12:55

Description

It would be nice to publish a page on the website or in the documentation describing the 'security model' of Roller, explaining both to operators and to security researchers what kind of behavior to expect.

For example, this page could clarify that blog authenticated weblog admins are trusted and can use HTML and JavaScript without limitation in blog titles, entries and other places in the blog.