You are viewing a plain text version of this content. The canonical link for it is here.
Posted to oak-issues@jackrabbit.apache.org by "Tobias Bocanegra (JIRA)" <ji...@apache.org> on 2015/09/01 12:34:45 UTC
[jira] [Created] (OAK-3324) hasPermission does not reflect actual
behavior with restrictions
Tobias Bocanegra created OAK-3324:
-------------------------------------
Summary: hasPermission does not reflect actual behavior with restrictions
Key: OAK-3324
URL: https://issues.apache.org/jira/browse/OAK-3324
Project: Jackrabbit Oak
Issue Type: Bug
Components: security
Affects Versions: 1.3.4
Reporter: Tobias Bocanegra
Assignee: Tobias Bocanegra
consider the following ACL setup:
{noformat}
testuser allow rep:read,rep:write /testroot
testuser deny jcr:removeNode /testroot/a glob=*/c
testuser allow jcr:removeNode /testroot/a glob=*/b
{noformat}
now: {{hasPermission(/tesroot/a/b/c, jcr:removeNode) == false}} but the user is still able to delete the node.
* if we change the order of the ACEs with the restriction, it works (i.e. the user can't delete)
* if we use direct ACLs on the respective nodes, it works
I think this is a bug...but I'm not sure if {{hasPermission}} is wrong, or the check during node deletion.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)