You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@jackrabbit.apache.org by Brian Moseley <bc...@osafoundation.org> on 2005/04/01 00:55:58 UTC
Re: litmus results
Angela Schreiber wrote:
> thanks a lot.
>
> i will sent you a commented list back, as soon as i'm
> through... i will spent some time on the locking, since
> jackrabbit now has the locking part build in.
excellent, thank you!
one other behavior i noted today was that when a user doesn't have
permission to view a repository item, the webdav response code is 404,
not 403 as i'd expect. any thoughts on this?
AW: litmus results
Posted by Daniel Florey <da...@web.de>.
What about discussing the mappings in the w3c-dist-auth mailinglist? There
are people around knowing a lot about the possible side-effects regarding
webdav-client software.
Keep on your great work!
Cheers,
Daniel
> -----Ursprüngliche Nachricht-----
> Von: jackrabbit-dev-return-1470-daniel.florey=web.de@incubator.apache.org
> [mailto:jackrabbit-dev-return-1470-
> daniel.florey=web.de@incubator.apache.org] Im Auftrag von Angela Schreiber
> Gesendet: Freitag, 1. April 2005 08:54
> An: jackrabbit-dev@incubator.apache.org
> Betreff: Re: litmus results
>
> Tobias Strasser wrote:
> > imo, the mapping should be:
> > PathNotFoundException -> 404
> > AccessDeneidException -> 403
> > RepositoryException -> 500 (or ev. precondition failed ?)
>
> i would prefer RepositoryException -> 403.
> for the complete mapping see:
>
> http://svn.day.com/repos/jcr-server/trunk/JCR_Webdav_Protocol.zip
> or
> http://svn.apache.org/repos/asf/incubator/jackrabbit/trunk/contrib/jcr-
> server/server/src/java/org/apache/jackrabbit/webdav/spi/JcrDavException.ja
> va
>
>
>
>
>
>
Re: litmus results
Posted by Angela Schreiber <an...@day.com>.
Tobias Strasser wrote:
> imo, the mapping should be:
> PathNotFoundException -> 404
> AccessDeneidException -> 403
> RepositoryException -> 500 (or ev. precondition failed ?)
i would prefer RepositoryException -> 403.
for the complete mapping see:
http://svn.day.com/repos/jcr-server/trunk/JCR_Webdav_Protocol.zip
or
http://svn.apache.org/repos/asf/incubator/jackrabbit/trunk/contrib/jcr-server/server/src/java/org/apache/jackrabbit/webdav/spi/JcrDavException.java
Re: litmus results
Posted by Tobias Strasser <to...@gmail.com>.
imo, the mapping should be:
PathNotFoundException -> 404
AccessDeneidException -> 403
RepositoryException -> 500 (or ev. precondition failed ?)
On Apr 1, 2005 8:13 AM, Angela Schreiber <an...@day.com> wrote:
> > one other behavior i noted today was that when a user doesn't have
> > permission to view a repository item, the webdav response code is 404,
> > not 403 as i'd expect. any thoughts on this?
>
> if the user is not allowed to see a certain item, Session.getItem
> will throw. i did not distinguish between the 2 exception that
> are possible: PathNotFound (404) and RepositoryException (any other
> error including AccessDeniedException).
>
> but i have not strong feelings regarding this. i can change it
> to throw in case of RepositoryException (resulting in 403).
> i will open a bug...
>
> regards
> angela
>
>
--
------------------------------------------< tobias.strasser@day.com >---
Tobias Strasser, Day Management AG, Barfuesserplatz 6, CH - 4001 Basel
T +41 61 226 98 98, F +41 61 226 98 97
-----------------------------------------------< http://www.day.com >---
Re: litmus results
Posted by Angela Schreiber <an...@day.com>.
> one other behavior i noted today was that when a user doesn't have
> permission to view a repository item, the webdav response code is 404,
> not 403 as i'd expect. any thoughts on this?
if the user is not allowed to see a certain item, Session.getItem
will throw. i did not distinguish between the 2 exception that
are possible: PathNotFound (404) and RepositoryException (any other
error including AccessDeniedException).
but i have not strong feelings regarding this. i can change it
to throw in case of RepositoryException (resulting in 403).
i will open a bug...
regards
angela
Re: litmus results
Posted by Tobias Strasser <to...@gmail.com>.
well, the server just populates the exceptions from the jcr170 api.
most of the 'access denieds' result in a 'itemnotfound' or
'pathnotfound' exceptions, since a AccessDeniedException would reveal
to much information.
for example, if you have:
/a/doument
/a/secret_document
and you issue: A.getNode("secret_document") and you have no read
permission for this item, you would get a ItemNotFound, same as for
A.getNode("foo"). If it would throw a AccessDenied for the
secret_document and an ItemNotFound for the 'foo', that would be too
much of information revealed.
cheers, tobi
On Apr 1, 2005 12:55 AM, Brian Moseley <bc...@osafoundation.org> wrote:
> Angela Schreiber wrote:
>
> > thanks a lot.
> >
> > i will sent you a commented list back, as soon as i'm
> > through... i will spent some time on the locking, since
> > jackrabbit now has the locking part build in.
>
> excellent, thank you!
>
> one other behavior i noted today was that when a user doesn't have
> permission to view a repository item, the webdav response code is 404,
> not 403 as i'd expect. any thoughts on this?
>
--
------------------------------------------< tobias.strasser@day.com >---
Tobias Strasser, Day Management AG, Barfuesserplatz 6, CH - 4001 Basel
T +41 61 226 98 98, F +41 61 226 98 97
-----------------------------------------------< http://www.day.com >---