Mailing-List: contact dev-help@jackrabbit.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@jackrabbit.apache.org
Message-ID: <499248721.1222184024290.JavaMail.jira@brutus>
Date: Tue, 23 Sep 2008 08:33:44 -0700 (PDT)
From: "Jukka Zitting (JIRA)" <jira@apache.org>
To: dev@jackrabbit.apache.org
Subject: [jira] Updated: (JCR-1743) Session.checkPermission: add_node and
 set_property evaluation are not handled differently
In-Reply-To: <1570657304.1221832844256.JavaMail.jira@brutus>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


     [ https://issues.apache.org/jira/browse/JCR-1743?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Jukka Zitting updated JCR-1743:
-------------------------------

    Component/s: security
                 jackrabbit-core
     Issue Type: Improvement  (was: Bug)

This is more an improvement than a bug fix, as the previous behaviour was clearly intentional.

> Session.checkPermission: add_node and set_property evaluation are not handled differently
> -----------------------------------------------------------------------------------------
>
>                 Key: JCR-1743
>                 URL: https://issues.apache.org/jira/browse/JCR-1743
>             Project: Jackrabbit
>          Issue Type: Improvement
>          Components: jackrabbit-core, security
>    Affects Versions: core 1.4.5
>            Reporter: Tobias Bocanegra
>            Assignee: Jukka Zitting
>             Fix For: core 1.4.6
>
>         Attachments: JCR-1743.patch
>
>
> if the property does not exist yet, Session.checkPermission invokes an AccessManager.checkPermission(... WRITE) for both cases. i.e. the access manager has no means for handle a "add_node" differently from a "set_property" 
> suggest to create a fake property id for the case where the property does not exist.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.