Mailing-List: contact jackrabbit-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: jackrabbit-dev@incubator.apache.org
Received-SPF: pass (hermes.apache.org: domain of bcm@osafoundation.org
 designates 204.152.186.98 as permitted sender)
Message-ID: <4251B34E.1080200@osafoundation.org>
Date: Mon, 04 Apr 2005 14:36:14 -0700
From: Brian Moseley <bcm@osafoundation.org>
User-Agent: Mozilla Thunderbird 1.0.2 (Macintosh/20050317)
MIME-Version: 1.0
To: jackrabbit-dev@incubator.apache.org
Subject: Item.remove() access control
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

i'm having an access control problem when removing an item (via WebDAV, 
but i suspect that's not relevant).

i'm issuing DELETE /webdav/bcm/litmus-results.txt as a regular user of 
my server who only has permissions on /webdav/bcm and below. 
DavResourceImpl calls remove() on the Item in question. somewhere below, 
my AccessManager is asked if read permission isGranted() on /. the 
answer to this question is false, and the DELETE fails with a 403.

if i then stop my server and restart it, the repository seems to be out 
of whack, in that PROPFIND /webdav/bcm/litmus-results.txt returns empty 
properties D:getlastmodified, D:getcontentlength, etc.

why is read permission checked on /? and what causes the erroneous 
PROPFIND response after the failed DELETE?

thanks!