You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@lenya.apache.org by bu...@apache.org on 2007/12/21 17:47:55 UTC
DO NOT REPLY [Bug 44120] New: - Creating sibling doesn't take AC into account
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=44120>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=44120
Summary: Creating sibling doesn't take AC into account
Product: Lenya
Version: Trunk
Platform: Other
OS/Version: other
Status: NEW
Severity: normal
Priority: P2
Component: Access Control
AssignedTo: dev@lenya.apache.org
ReportedBy: rfrovarp@apache.org
If a user has permissions on a node to create pages (edit), they can create a
new page as a sibling of that node, even if they don't have proper permissions
on the parent. The page is then created as a sibling, and they don't have any
permissions to the page. Since this can be seen as a way around the permission
tree, they shouldn't be given permission to do so. When the sibling option is
chosen, the permission check should be done against the parent.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org
DO NOT REPLY [Bug 44120] - Creating sibling doesn't take AC into account
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=44120>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=44120
------- Additional Comments From andreas@apache.org 2008-02-22 06:38 -------
This bug is based on a fundamental flaw of our access control strategy. We only
care for protecting usecases on pages, but there's no protection of the
repository itself.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org
DO NOT REPLY [Bug 44120] - Creating sibling doesn't take AC into account
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=44120>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=44120
------- Additional Comments From rfrovarp@apache.org 2008-02-22 07:07 -------
I was wondering if we could just run the check that would initially prevent
access to the usecase again but with the right parent in the tree. However, I
haven't had a chance to investigate how this would be done exactly.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org