jackrabbit-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "angela (JIRA)" <j...@apache.org>
Subject [jira] [Created] (JCR-2951) Item.remove fails if a child-item is not visible to the editing session
Date Wed, 27 Apr 2011 16:00:03 GMT
Item.remove fails if a child-item is not visible to the editing session
-----------------------------------------------------------------------

                 Key: JCR-2951
                 URL: https://issues.apache.org/jira/browse/JCR-2951
             Project: Jackrabbit Content Repository
          Issue Type: Bug
          Components: jackrabbit-core
            Reporter: angela


the following test setup fails:

- a given session is allowed to remove a node
- the node has a policy child node which is not visible to the editing session (missing ac-read
permission)
  OR the node has another invisible child item which could - based on the permissions above
- be removed by that session.

calling Node.remove however fails with accessdeniedexception because the internal remove
mechanism accesses all child items to mark them removed. however, the access is executed
using the regular itemmgr calls that are used to retrieve the items using the JCR API which
results in accessdenied exception as those child items are not visible to the session.
since the items can be removed i would argue that this is a bug in the internal remove process.


--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira

Mime
View raw message