Mailing-List: contact users-help@jackrabbit.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@jackrabbit.apache.org
Received-SPF: pass (athena.apache.org: domain of aklimets@adobe.com designates
 64.18.1.185 as permitted sender)
From: Alexander Klimetschek <aklimets@adobe.com>
To: "users@jackrabbit.apache.org" <users@jackrabbit.apache.org>
Date: Fri, 30 Sep 2011 17:00:39 +0100
Subject: Re: ACLs, GlobPattern and move
Thread-Topic: ACLs, GlobPattern and move
Thread-Index: Acx/ihozFx2+Sm5GRHKml2qe24vkwA==
Message-ID: <CAABB28E.8C17D%aklimets@adobe.com>
In-Reply-To: 
 <CAKhi2WN1yMwxUB9RCOgpMvV5-vEaGyvLgMFfSi3YxsU6Vn0F=Q@mail.gmail.com>
Accept-Language: de-DE, en-US
Content-Language: en-US
user-agent: Microsoft-MacOutlook/14.13.0.110805
acceptlanguage: de-DE, en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

On 30.09.11 15:48, "Markus Joschko" <markus.joschko@gmail.com> wrote:
>I am not completely sure on this. At the moment I am totally confused
>about the behavior.
>With a mix of davex client and serverside sessions I've seen the
>described leakage: Only for newly created sessions the acls applied.
>
>On the other hand I just have written a test that works solely with an
>embedded jackrabbit and two sessions (admin & user) and here security
>seems to apply immediately on move, no leakage.

If you use Workspace.move() that this is working outside of a session (no
session.save() needed), i.e. acts like a new session.

>Should it really only work with newly created session then that is IMO
>a security risk.

Hmm, yes, maybe I am wrong :-)

>In a setup like /departmentA/topsecret where topsecret is denied in
>rep:glob, topsecret should certainly not be visible to anyone even
>when the department is moved to /departmentB.

Yes.

Alex

--=20
Alexander Klimetschek
Developer // Adobe (Day) // Berlin - Basel