Mailing-List: contact dev-help@jackrabbit.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@jackrabbit.apache.org
Date: Wed, 29 Jun 2011 15:25:28 +0000 (UTC)
From: "Lars Krapf (JIRA)" <jira@apache.org>
To: dev@jackrabbit.apache.org
Message-ID: 
 <723617627.2803.1309361128891.JavaMail.tomcat@hel.zones.apache.org>
In-Reply-To: 
 <1332788457.2796.1309360888420.JavaMail.tomcat@hel.zones.apache.org>
Subject: [jira] [Updated] (JCR-3007) setProperty access control evaluation
 does not properly cope with XA transactions
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


     [ https://issues.apache.org/jira/browse/JCR-3007?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Lars Krapf updated JCR-3007:
----------------------------

    Attachment: transaction.patch

> setProperty access control evaluation does not properly cope with XA transactions
> ---------------------------------------------------------------------------------
>
>                 Key: JCR-3007
>                 URL: https://issues.apache.org/jira/browse/JCR-3007
>             Project: Jackrabbit Content Repository
>          Issue Type: Bug
>          Components: jackrabbit-core
>    Affects Versions: 2.2.7
>            Reporter: Lars Krapf
>              Labels: jackrabbit-core,, security,, transactions
>         Attachments: transaction.patch
>
>
> This is another instance of the problems with ACL evaluation within transactions described in https://issues.apache.org/jira/browse/JCR-2999.
> In this case PropertyImpl#getParent() called from PropertyImpl#checkSetValue() is trying to check read permissions of the yet uncommited parent and thus fails with an ItemNotFound exception.
> The problem is reproducible with the following test:
> public void testTransaction() throws Exception {
>         // make sure testUser has all privileges
>         Privilege[] privileges = privilegesFromName(Privilege.JCR_ALL);
>         givePrivileges(path, privileges, getRestrictions(superuser, path));
>         // create new node and lock it
>         Session s = getTestSession();
>         UserTransaction utx = new UserTransactionImpl(s);
>         utx.begin();
>         // add node and save it
>         Node n = s.getNode(childNPath);
>         if (n.hasNode(nodeName1)) {
>             Node c = n.getNode(nodeName1);
>             c.remove();
>             s.save();
>         }
>         // create node and save
>         Node n2 = n.addNode(nodeName1);
>         s.save(); // -> node is NEW -> no failure
>         // set a property on a child node of an uncommited parent
>         n2.setProperty(propertyName1, "testSetProperty");
>         s.save();  // -> fail because PropertyImpl#getParent called from PropertyImpl#checkSetValue
>                        //    was checking read permission on the not yet commited parent
>         // commit
>         utx.commit();
>     }

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira