Merge pull request #839 from permaweb/samcamwilliams/isTrustedFix

fix: In the event of having no authorities on the list, trust no-one.
permaweb · Jun 30, 2024 · 0f6f99f · 0f6f99f
2 parents df54389 + 9a73306
commit 0f6f99f
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/dev-cli/container/src/ao.lua b/dev-cli/container/src/ao.lua
@@ -175,9 +175,9 @@ function ao.assign(assignment)
     table.insert(ao.outbox.Assignments, assignment)
 end
 
+-- The default security model of AOS processes: Trust all and *only* those
+-- on the ao.authorities list.
 function ao.isTrusted(msg)
-    if #ao.authorities == 0 then return true end
-
     for _, authority in ipairs(ao.authorities) do
         if msg.From == authority then return true end
         if msg.Owner == authority then return true end