--- a/libervia.tac	Fri Sep 06 16:23:30 2013 +0200
+++ b/libervia.tac	Sat Sep 07 02:07:07 2013 +0200
@@ -39,6 +39,9 @@
 import tempfile, shutil, uuid
 from server_side.blog import MicroBlog
 from zope.interface import Interface, Attribute, implements
+from xml.dom import minidom
+
+
 #import time
 
 TIMEOUT = 300 #Session's time out, after that the user will be disconnected
@@ -47,6 +50,9 @@
 AVATARS_DIR = "avatars/"
 CARDS_DIR = "games/cards/tarot"
 
+# Security limit for Libervia (get/set params)
+SECURITY_LIMIT = 0
+
 class ISATSession(Interface):
     profile = Attribute("Sat profile")
     jid = Attribute("JID associated with the profile")
@@ -121,6 +127,7 @@
     def __init__(self, sat_host):
         jsonrpc.JSONRPC.__init__(self)
         self.sat_host=sat_host
+        self.authorized_params = None
 
     def render(self, request):
         self.session = request.getSession()
@@ -353,16 +360,33 @@
         return self.sat_host.bridge.getCard(jid, profile)
 
     def jsonrpc_getParamsUI(self):
-        """Return the parameters XMLUI for profile"""
+        """Return the parameters XML for profile"""
         profile = ISATSession(self.session).profile
         d = defer.Deferred()
-        security_limit = 0
-        self.sat_host.bridge.getParamsUI(security_limit, profile, callback=d.callback, errback=d.errback)
+
+        def setAuthorizedParams(d):
+            if self.authorized_params is None:
+                self.authorized_params = {}
+                for cat in minidom.parseString(d.encode('utf-8')).getElementsByTagName("category"):
+                    params = cat.getElementsByTagName("param")
+                    params_list = [param.getAttribute("name") for param in params]
+                    self.authorized_params[cat.getAttribute("name")] = params_list
+            return d
+        d.addCallback(setAuthorizedParams)
+
+        from sat.tools.xml_tools import paramsXml2xmlUI
+        d.addCallback(lambda d: paramsXml2xmlUI(d))
+
+        self.sat_host.bridge.getParams(SECURITY_LIMIT, profile, callback=d.callback, errback=d.errback)
         return d
 
     def jsonrpc_setParam(self, name, value, category):
         profile = ISATSession(self.session).profile
-        return self.sat_host.bridge.setParam(name, value, category, profile)
+        if category in self.authorized_params and name in self.authorized_params[category]:
+            return self.sat_host.bridge.setParam(name, value, category, SECURITY_LIMIT, profile)
+        else:
+            warning("Trying to set parameter '%s' in category '%s' without authorization!!!"
+                    % (name, category))
 
     def jsonrpc_launchAction(self, action_type, data):
         profile = ISATSession(self.session).profile