You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@jackrabbit.apache.org by "Tobias Bocanegra (JIRA)" <ji...@apache.org> on 2008/09/29 13:46:44 UTC
[jira] Commented: (JCR-1743) Session.checkPermission: add_node and
set_property evaluation are not handled differently
[ https://issues.apache.org/jira/browse/JCR-1743?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12635360#action_12635360 ]
Tobias Bocanegra commented on JCR-1743:
---------------------------------------
how about extending the access manager in a way that set_property and add_node are handled differently?
the accessmanager can still decide, if it wants to use the old or the new behavior.
> Session.checkPermission: add_node and set_property evaluation are not handled differently
> -----------------------------------------------------------------------------------------
>
> Key: JCR-1743
> URL: https://issues.apache.org/jira/browse/JCR-1743
> Project: Jackrabbit
> Issue Type: Improvement
> Components: jackrabbit-core, security
> Affects Versions: core 1.4.5
> Reporter: Tobias Bocanegra
> Assignee: Jukka Zitting
> Attachments: JCR-1743-alternative.patch, JCR-1743.patch
>
>
> if the property does not exist yet, Session.checkPermission invokes an AccessManager.checkPermission(... WRITE) for both cases. i.e. the access manager has no means for handle a "add_node" differently from a "set_property"
> suggest to create a fake property id for the case where the property does not exist.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.