jackrabbit-oak-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Tobias Bocanegra (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (OAK-3324) hasPermission does not reflect actual behavior with restrictions
Date Fri, 04 Sep 2015 11:54:45 GMT

    [ https://issues.apache.org/jira/browse/OAK-3324?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14730683#comment-14730683
] 

Tobias Bocanegra commented on OAK-3324:
---------------------------------------

just realised the difference between {{hasPrivilege()}} and {{isGranted()}} - so the test
was wrong.

added updated test in r1701223.

however, there is still an inconsistency in the way how restrictions are evaluated.
in the the case of:
{noformat}
testuser allow rep:read,rep:write      /testroot
testuser deny  jcr:removeNode /testroot/a  glob=*/c
testuser allow jcr:removeNode /testroot/a  glob=*/b
{noformat}

the user is granted REMOVE_NODE on /a/b/c, since the evaluation considers both entries on
/testroot/a, when it checks the parent of 'c' (because the REMOVE_NODE requires a check of
the parent).
but the user is not granted REMOVE_NODE on /a/b/c/d, since the evaluation aborts after it
encounters the deny.

see https://github.com/apache/jackrabbit-oak/blob/trunk/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/restriction/PermissionTest.java#L150

> hasPermission does not reflect actual behavior with restrictions
> ----------------------------------------------------------------
>
>                 Key: OAK-3324
>                 URL: https://issues.apache.org/jira/browse/OAK-3324
>             Project: Jackrabbit Oak
>          Issue Type: Bug
>          Components: security
>    Affects Versions: 1.3.4
>            Reporter: Tobias Bocanegra
>            Assignee: Tobias Bocanegra
>
> consider the following ACL setup:
> {noformat}
> testuser allow rep:read,rep:write      /testroot
> testuser deny  jcr:removeNode /testroot/a  glob=*/c
> testuser allow jcr:removeNode /testroot/a  glob=*/b
> {noformat}
> now: {{hasPermission(/tesroot/a/b/c, jcr:removeNode) == false}} but the user is still
able to delete the node.
> * if we change the order of the ACEs with the restriction, it works (i.e. the user can't
delete)
> * if we use direct ACLs on the respective nodes, it works
> I think this is a bug...but I'm not sure if {{hasPermission}} is wrong, or the check
during node deletion.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message