[jira] [Updated] (JCR-2951) Item.remove fails if a child-item is not visible to the editing session

["angela (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/JCR-2951?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

angela updated JCR-2951:
------------------------

    Status: Patch Available  (was: Open)

> Item.remove fails if a child-item is not visible to the editing session
> -----------------------------------------------------------------------
>
>                 Key: JCR-2951
>                 URL: https://issues.apache.org/jira/browse/JCR-2951
>             Project: Jackrabbit Content Repository
>          Issue Type: Bug
>          Components: jackrabbit-core
>            Reporter: angela
>         Attachments: JCR-2951.patch
>
>
> the following test setup fails:
> - a given session is allowed to remove a node
> - the node has a policy child node which is not visible to the editing session (missing ac-read permission)
>   OR the node has another invisible child item which could - based on the permissions above - be removed by that session.
> calling Node.remove however fails with accessdeniedexception because the internal remove
> mechanism accesses all child items to mark them removed. however, the access is executed
> using the regular itemmgr calls that are used to retrieve the items using the JCR API which
> results in accessdenied exception as those child items are not visible to the session.
> since the items can be removed i would argue that this is a bug in the internal remove process.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira