jackrabbit-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Stefan Guggisberg (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (JCR-2951) Item.remove fails if a child-item is not visible to the editing session
Date Thu, 28 Apr 2011 08:09:08 GMT

    [ https://issues.apache.org/jira/browse/JCR-2951?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13026188#comment-13026188
] 

Stefan Guggisberg commented on JCR-2951:
----------------------------------------

+1 for the patch, thanks!

> Item.remove fails if a child-item is not visible to the editing session
> -----------------------------------------------------------------------
>
>                 Key: JCR-2951
>                 URL: https://issues.apache.org/jira/browse/JCR-2951
>             Project: Jackrabbit Content Repository
>          Issue Type: Bug
>          Components: jackrabbit-core
>            Reporter: angela
>            Assignee: angela
>         Attachments: JCR-2951.patch
>
>
> the following test setup fails:
> - a given session is allowed to remove a node
> - the node has a policy child node which is not visible to the editing session (missing
ac-read permission)
>   OR the node has another invisible child item which could - based on the permissions
above - be removed by that session.
> calling Node.remove however fails with accessdeniedexception because the internal remove
> mechanism accesses all child items to mark them removed. however, the access is executed
> using the regular itemmgr calls that are used to retrieve the items using the JCR API
which
> results in accessdenied exception as those child items are not visible to the session.
> since the items can be removed i would argue that this is a bug in the internal remove
process.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira

Mime
View raw message