You are viewing a plain text version of this content. The canonical link for it is here.

Posted to oak-issues@jackrabbit.apache.org by "Marcel Reutegger (Jira)" <ji...@apache.org> on 2023/08/25 07:34:00 UTC

[jira] [Commented] (OAK-10334) Node.addMixin() may overwrite existing mixins

    [ https://issues.apache.org/jira/browse/OAK-10334?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17758860#comment-17758860 ] 

Marcel Reutegger commented on OAK-10334:
----------------------------------------

Based on review feedback in the PR the proposed fix now correctly updates jcr:mixinTypes even when the session does not have read permission on the property. This is consistent with the behaviour described in OAK-2441.

> Node.addMixin() may overwrite existing mixins
> ---------------------------------------------
>
>                 Key: OAK-10334
>                 URL: https://issues.apache.org/jira/browse/OAK-10334
>             Project: Jackrabbit Oak
>          Issue Type: Bug
>          Components: jcr
>            Reporter: Marcel Reutegger
>            Assignee: Marcel Reutegger
>            Priority: Major
>
> A Session lacking permission to read property jcr:mixinTypes, but permission to write will overwrite existing mixins when calling Node.addMixin().
> The implementation does not check if the session has permission to read jcr:mixinTypes and assumes there are no existing values when the session does not have permission. The result is a jcr:mixinTypes property with only a single value passed to addMixin().



--
This message was sent by Atlassian Jira
(v8.20.10#820010)