[jira] [Commented] (OAK-2412) Rep:glob in Access Control List Entry with empty value is not correcty handled

["Chetanya Jain (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/OAK-2412?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15143776#comment-15143776 ] 

Chetanya Jain commented on OAK-2412:
------------------------------------

Hi Angela,

For a nodePath /foo:
1. Giving allow with rep:glob = "" -> ensures that it matches /foo only
2. Giving deny with rep:glob = /* -> ensures that all descendants of /foo are denied (assuming a user has read access on "/")
3. Giving deny with rep:glob = /cat* -> ensures that all descendant path of /foo that have the direct foo-descendant segment starting with ‘cat’ are denied (assuming a user has read access on "/")

The rule 1 & 3 works perfectly fine after giving read access on jcr:primaryType, however rule 2 doesn't work.

Can you look into this?

Thanks,
Chetanya

> Rep:glob in Access Control List Entry with empty value is not correcty handled
> ------------------------------------------------------------------------------
>
>                 Key: OAK-2412
>                 URL: https://issues.apache.org/jira/browse/OAK-2412
>             Project: Jackrabbit Oak
>          Issue Type: Bug
>          Components: core
>    Affects Versions: 1.0.5
>            Reporter: Roland Gruber
>            Assignee: angela
>         Attachments: OAK-2412_testJackrabbit.patch, OAK-2412_testJackrabbit_2.patch, OAK-2412_testOak.patch, OAK-2412_testOak_2.patch, acl_baseNode.png, acl_project1Node.png, acl_project2Node.png
>
>
> Setting a rep:glob with empty value ("") should restrict an ACL entry to the current node. This seems to no longer work (working wiith CRX2).
> See:
> http://jackrabbit.apache.org/api/2.2/org/apache/jackrabbit/core/security/authorization/GlobPattern.html
> How to reproduce:
> 1. Set a deny rule on a node with jcr:read and no rep:glob
> 2. Set an allow rule to the same node with rep:glob ""
> Expected result: Node is readable (subnodes are not readable)
> Actual result: Node is not readable



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)