[jira] [Updated] (OAK-2412) Rep:glob in Access Control List Entry with empty value is not correcty handled

["angela (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/OAK-2412?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

angela updated OAK-2412:
------------------------
    Attachment: OAK-2412_testJackrabbit.patch
                OAK-2412_testOak.patch

I tried to reproduce the issue as described above and wrote the equivalent test case both for Oak and Jackrabbit.

the test case is based on a simple hierarchy of node below the testNode and does the following for the test session:
- revoke read-access (which is granted by the test-setup)
  -> assert the node and subtree is no longer accessible
- grant read access with empty restriction on the child node
  -> parent must still be hidden
  -> child node must be accessible
  -> all child items of child must not be accessible
- finally grant read access below the child-node with empty restriction
  -> that subtree must be readable

from what i can see, that works as intended both in Oak and Jackrabbit 2.x.
may i kindly ask you to verify if the test-case really reflects your test setup and report back in case you were testing something different (in which case i would adjust the test-cases). thanks.

> Rep:glob in Access Control List Entry with empty value is not correcty handled
> ------------------------------------------------------------------------------
>
>                 Key: OAK-2412
>                 URL: https://issues.apache.org/jira/browse/OAK-2412
>             Project: Jackrabbit Oak
>          Issue Type: Bug
>          Components: core
>    Affects Versions: 1.0.5
>            Reporter: Roland Gruber
>            Assignee: angela
>         Attachments: OAK-2412_testJackrabbit.patch, OAK-2412_testOak.patch
>
>
> Setting a rep:glob with empty value ("") should restrict an ACL entry to the current node. This seems to no longer work (working wiith CRX2).
> See:
> http://jackrabbit.apache.org/api/2.2/org/apache/jackrabbit/core/security/authorization/GlobPattern.html
> How to reproduce:
> 1. Set a deny rule on a node with jcr:read and no rep:glob
> 2. Set an allow rule to the same node with rep:glob ""
> Expected result: Node is readable (subnodes are not readable)
> Actual result: Node is not readable



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)