| Subject: | existing user attribute validation should be modifyable |
Users of the CAS package need to be able to define their own validation
methods.
For predefined (UserInfo) user attributes this could be as simple as
accepting a coderef. This could possibly open security holes, but if the
coderef is called in an eval (or even better a sandbox) and is only
given the value of the attribute to be validated it should be reasonably
safe. (?) However this method means that the developer using CAS needs
to have that fed in in programs. Perhaps there should be a methodology
to include the code from a conf file instead or as well, so it is
'native' to the object?
Solving this should consider how allowing developers to define
validation methods for clients supl. user table attributes as well.