[jira] Commented: (JCR-1743) Session.checkPermission: add_node and set_property evaluation are not handled differently

["angela (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/JCR-1743?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12662399#action_12662399 ] 

angela commented on JCR-1743:
-----------------------------

with jackrabbit >= 1.5 the permission check has changed and the former AccessManager constants are deprecated and the methods taking itemId are not used any more.

i guess we can close that one fixed, unless we create a 1.4.7 that requires a specific fix for releases < 1.5

> Session.checkPermission: add_node and set_property evaluation are not handled differently
> -----------------------------------------------------------------------------------------
>
>                 Key: JCR-1743
>                 URL: https://issues.apache.org/jira/browse/JCR-1743
>             Project: Jackrabbit
>          Issue Type: Improvement
>          Components: jackrabbit-core, security
>    Affects Versions: core 1.4.5
>            Reporter: Tobias Bocanegra
>            Assignee: Jukka Zitting
>         Attachments: JCR-1743-alternative.patch, JCR-1743.patch
>
>
> if the property does not exist yet, Session.checkPermission invokes an AccessManager.checkPermission(... WRITE) for both cases. i.e. the access manager has no means for handle a "add_node" differently from a "set_property" 
> suggest to create a fake property id for the case where the property does not exist.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.