jackrabbit-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From ang...@apache.org
Subject svn commit: r720484 - in /jackrabbit/trunk/jackrabbit-core/src: main/java/org/apache/jackrabbit/core/ test/java/org/apache/jackrabbit/api/jsr283/security/ test/java/org/apache/jackrabbit/core/security/authorization/
Date Tue, 25 Nov 2008 12:59:30 GMT
Author: angela
Date: Tue Nov 25 04:59:28 2008
New Revision: 720484

URL: http://svn.apache.org/viewvc?rev=720484&view=rev
Log:
JCR-1613: REMOVE access is not checked when moving a node

Added:
    jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/api/jsr283/security/RSessionAccessControlTest.java
  (with props)
Modified:
    jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/SessionImpl.java
    jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/api/jsr283/security/TestAll.java
    jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/AbstractEvaluationTest.java

Modified: jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/SessionImpl.java
URL: http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/SessionImpl.java?rev=720484&r1=720483&r2=720484&view=diff
==============================================================================
--- jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/SessionImpl.java
(original)
+++ jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/SessionImpl.java
Tue Nov 25 04:59:28 2008
@@ -1017,6 +1017,15 @@
             index = 1;
         }
 
+        // check permissions
+        AccessManager acMgr = getAccessManager();
+        if (!(acMgr.isGranted(srcPath, Permission.REMOVE_NODE) &&
+                acMgr.isGranted(destPath, Permission.ADD_NODE))) {
+            String msg = "Not allowed to move node " + srcAbsPath + " to " + destAbsPath;
+            log.debug(msg);
+            throw new AccessDeniedException(msg);
+        }
+
         if (srcParentNode.isSame(destParentNode)) {
             // do rename
             destParentNode.renameChildNode(srcName.getName(), index, targetId, destName.getName());

Added: jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/api/jsr283/security/RSessionAccessControlTest.java
URL: http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/api/jsr283/security/RSessionAccessControlTest.java?rev=720484&view=auto
==============================================================================
--- jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/api/jsr283/security/RSessionAccessControlTest.java
(added)
+++ jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/api/jsr283/security/RSessionAccessControlTest.java
Tue Nov 25 04:59:28 2008
@@ -0,0 +1,137 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jackrabbit.api.jsr283.security;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.apache.jackrabbit.test.AbstractJCRTest;
+
+import javax.jcr.Node;
+import javax.jcr.Property;
+import javax.jcr.Session;
+import javax.jcr.RepositoryException;
+import javax.jcr.AccessDeniedException;
+
+/** <code>RSessionAccessControlTest</code>... */
+public class RSessionAccessControlTest extends AbstractJCRTest {
+
+    private static Logger log = LoggerFactory.getLogger(RSessionAccessControlTest.class);
+
+    private Session readOnlySession;
+    private String testNodePath;
+    private String testPropertyPath;
+
+    protected void setUp() throws Exception {
+        super.setUp();
+        Node n = testRootNode.addNode(nodeName1, testNodeType);
+        testNodePath = n.getPath();
+        Property p = n.setProperty(propertyName1, "value");
+        testPropertyPath = p.getPath();
+        testRootNode.save();
+
+        readOnlySession = helper.getReadOnlySession();
+    }
+
+    protected void tearDown() throws Exception {
+        if (readOnlySession != null) {
+            readOnlySession.logout();
+        }
+        super.tearDown();
+    }
+
+    public void testSetProperty() throws RepositoryException {
+        Node n = (Node) readOnlySession.getItem(testNodePath);
+        try {
+            n.setProperty(propertyName1, "otherValue");
+            n.save();
+            fail("A read only session must not be allowed to modify a property value");
+        } catch (AccessDeniedException e) {
+            // success
+        }
+    }
+
+    public void testSetValue() throws RepositoryException {
+        Property p = (Property) readOnlySession.getItem(testPropertyPath);
+        try {
+            p.setValue("otherValue");
+            p.save();
+            fail("A read only session must not be allowed to modify a property value");
+        } catch (AccessDeniedException e) {
+            // success
+        }
+    }
+
+    public void testDeleteNode() throws Exception {
+        Node n = (Node) readOnlySession.getItem(testNodePath);
+        try {
+            n.remove();
+            readOnlySession.save();
+            fail("A read only session must not be allowed to remove a node");
+        } catch (AccessDeniedException e) {
+            // success
+        }
+    }
+
+    public void testDeleteProperty() throws Exception {
+        Property p = (Property) readOnlySession.getItem(testPropertyPath);
+        try {
+            p.remove();
+            readOnlySession.save();
+            fail("A read only session must not be allowed to remove a property.");
+        } catch (AccessDeniedException e) {
+            // success
+        }
+    }
+
+    public void testMoveNode() throws Exception {
+        Node n = (Node) readOnlySession.getItem(testNodePath);
+        String destPath = testRootNode.getPath() + "/" + nodeName2;
+
+        try {
+            readOnlySession.move(n.getPath(), destPath);
+            readOnlySession.save();
+            fail("A read only session must not be allowed to move a node");
+        } catch (AccessDeniedException e) {
+            // expected
+            log.debug(e.getMessage());
+        }
+    }
+
+    public void testWorkspaceMoveNode() throws Exception {
+        Node n = (Node) readOnlySession.getItem(testNodePath);
+        String destPath = testRootNode.getPath() + "/" + nodeName2;
+        try {
+            readOnlySession.getWorkspace().move(n.getPath(), destPath);
+            fail("A read only session must not be allowed to move a node");
+        } catch (AccessDeniedException e) {
+            // expected
+            log.debug(e.getMessage());
+        }
+    }
+
+    public void testCopyNode() throws Exception {
+        Node n = (Node) readOnlySession.getItem(testNodePath);
+        String destPath = testRootNode.getPath() + "/" + nodeName2;
+        try {
+            readOnlySession.getWorkspace().copy(n.getPath(), destPath);
+            fail("A read only session must not be allowed to copy a node");
+        } catch (AccessDeniedException e) {
+            // expected
+            log.debug(e.getMessage());
+        }
+    }
+}
\ No newline at end of file

Propchange: jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/api/jsr283/security/RSessionAccessControlTest.java
------------------------------------------------------------------------------
    svn:eol-style = native

Propchange: jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/api/jsr283/security/RSessionAccessControlTest.java
------------------------------------------------------------------------------
    svn:keywords = author date id revision url

Modified: jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/api/jsr283/security/TestAll.java
URL: http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/api/jsr283/security/TestAll.java?rev=720484&r1=720483&r2=720484&view=diff
==============================================================================
--- jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/api/jsr283/security/TestAll.java
(original)
+++ jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/api/jsr283/security/TestAll.java
Tue Nov 25 04:59:28 2008
@@ -46,6 +46,7 @@
         // tests with read only session:
         suite.addTestSuite(RSessionAccessControlDiscoveryTest.class);
         suite.addTestSuite(RSessionAccessControlPolicyTest.class);
+        suite.addTestSuite(RSessionAccessControlTest.class);
 
         return suite;
     }

Modified: jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/AbstractEvaluationTest.java
URL: http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/AbstractEvaluationTest.java?rev=720484&r1=720483&r2=720484&view=diff
==============================================================================
--- jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/AbstractEvaluationTest.java
(original)
+++ jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/AbstractEvaluationTest.java
Tue Nov 25 04:59:28 2008
@@ -728,7 +728,7 @@
 
         // add 'remove_child_nodes' at 'path
         givePrivileges(path, rmChildNodes, getRestrictions(path));
-        // deny 'remove_nodes' at 'path'
+        // deny 'remove_node' at 'path'
         withdrawPrivileges(path, rmNode, getRestrictions(path));
         // and allow 'remove_node' at childNPath
         givePrivileges(childNPath, rmNode, getRestrictions(childNPath));
@@ -740,6 +740,108 @@
         assertTrue(testAcMgr.hasPrivileges(childNPath, new Privilege[] {rmChildNodes[0],
rmNode[0]}));
     }
 
+    public void testSessionMove() throws RepositoryException, NotExecutableException {
+        SessionImpl testSession = getTestSession();
+        AccessControlManager testAcMgr = getTestACManager();
+        /*
+          precondition:
+          testuser must have READ-only permission on test-node and below
+        */
+        checkReadOnly(path);
+        checkReadOnly(childNPath);
+
+        String destPath = path + "/" + nodeName1;
+
+        // give 'add_child_nodes' privilege
+        // -> not sufficient privileges for a move
+        givePrivileges(path, privilegesFromName(Privilege.JCR_ADD_CHILD_NODES), getRestrictions(path));
+        try {
+            testSession.move(childNPath, destPath);
+            testSession.save();
+            fail("Move requires add and remove permission.");
+        } catch (AccessDeniedException e) {
+            // success.
+        }
+
+        // add 'remove_child_nodes' at 'path
+        // -> not sufficient for a move since 'remove_node' privilege is missing
+        //    on the move-target
+        givePrivileges(path, privilegesFromName(Privilege.JCR_REMOVE_CHILD_NODES), getRestrictions(path));
+        try {
+            testSession.move(childNPath, destPath);
+            testSession.save();
+            fail("Move requires add and remove permission.");
+        } catch (AccessDeniedException e) {
+            // success.
+        }
+
+        // allow 'remove_node' at childNPath
+        // -> now move must succeed
+        givePrivileges(childNPath, privilegesFromName(Privilege.JCR_REMOVE_NODE), getRestrictions(childNPath));
+        testSession.move(childNPath, destPath);
+        testSession.save();
+
+        // withdraw  'add_child_nodes' privilege on former src-parent
+        // -> moving child-node back must fail
+        withdrawPrivileges(path, privilegesFromName(Privilege.JCR_ADD_CHILD_NODES), getRestrictions(path));
+        try {
+            testSession.move(destPath, childNPath);
+            testSession.save();
+            fail("Move requires add and remove permission.");
+        } catch (AccessDeniedException e) {
+            // success.
+        }
+    }
+
+    public void testWorkspaceMove() throws RepositoryException, NotExecutableException {
+        SessionImpl testSession = getTestSession();
+        AccessControlManager testAcMgr = getTestACManager();
+        /*
+          precondition:
+          testuser must have READ-only permission on test-node and below
+        */
+        checkReadOnly(path);
+        checkReadOnly(childNPath);
+
+        String destPath = path + "/" + nodeName1;
+
+        // give 'add_child_nodes' privilege
+        // -> not sufficient privileges for a move.
+        givePrivileges(path, privilegesFromName(Privilege.JCR_ADD_CHILD_NODES), getRestrictions(path));
+        try {
+            testSession.getWorkspace().move(childNPath, destPath);
+            fail("Move requires add and remove permission.");
+        } catch (AccessDeniedException e) {
+            // success.
+        }
+
+        // add 'remove_child_nodes' at 'path
+        // -> no sufficient for a move since 'remove_node' privilege is missing
+        //    on the move-target
+        givePrivileges(path, privilegesFromName(Privilege.JCR_REMOVE_CHILD_NODES), getRestrictions(path));
+        try {
+            testSession.getWorkspace().move(childNPath, destPath);
+            fail("Move requires add and remove permission.");
+        } catch (AccessDeniedException e) {
+            // success.
+        }
+
+        // allow 'remove_node' at childNPath
+        // -> now move must succeed
+        givePrivileges(childNPath, privilegesFromName(Privilege.JCR_REMOVE_NODE), getRestrictions(childNPath));
+        testSession.getWorkspace().move(childNPath, destPath);
+
+        // withdraw  'add_child_nodes' privilege on former src-parent
+        // -> moving child-node back must fail
+        withdrawPrivileges(path, privilegesFromName(Privilege.JCR_ADD_CHILD_NODES), getRestrictions(path));
+        try {
+            testSession.getWorkspace().move(destPath, childNPath);
+            fail("Move requires add and remove permission.");
+        } catch (AccessDeniedException e) {
+            // success.
+        }
+    }
+
     public void testGroupPermissions() throws NotExecutableException, RepositoryException
{
         Group testGroup = getTestGroup();
         SessionImpl testSession = getTestSession();



Mime
View raw message