Mailing-List: contact users-help@jackrabbit.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@jackrabbit.apache.org
Received-SPF: pass (nike.apache.org: domain of markus.joschko@gmail.com
 designates 74.125.82.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAAB8B2C.8C09F%aklimets@adobe.com>
References: 
 <CAKhi2WPTJZg8zj6+_BSxmJaDOmw53=wWyxDszsVyf96k6Rx64A@mail.gmail.com>
	<CAAB8B2C.8C09F%aklimets@adobe.com>
Date: Fri, 30 Sep 2011 15:48:14 +0200
Message-ID: 
 <CAKhi2WN1yMwxUB9RCOgpMvV5-vEaGyvLgMFfSi3YxsU6Vn0F=Q@mail.gmail.com>
Subject: Re: ACLs, GlobPattern and move
From: Markus Joschko <markus.joschko@gmail.com>
To: users@jackrabbit.apache.org
Content-Type: text/plain; charset=ISO-8859-1

On Fri, Sep 30, 2011 at 3:06 PM, Alexander Klimetschek
<aklimets@adobe.com> wrote:
> On 28.09.11 09:34, "Markus Joschko" <markus.joschko@gmail.com> wrote:
>>Yep, I tried a refresh on the session with no effect. I also fetch the
>>node everytime again with the getNode(path) method on the session.
>>Does anybody know if there is a difference in the permission handling
>>between CRX and jackrabbit?
>>How are the permissions cached and when is the cache invalidated?
>
> AFAIK if you change permissions, they will only apply to newly created
> sessions.

I am not completely sure on this. At the moment I am totally confused
about the behavior.
With a mix of davex client and serverside sessions I've seen the
described leakage: Only for newly created sessions the acls applied.

On the other hand I just have written a test that works solely with an
embedded jackrabbit and two sessions (admin & user) and here security
seems to apply immediately on move, no leakage.

Should it really only work with newly created session then that is IMO
a security risk.
In a setup like /departmentA/topsecret where topsecret is denied in
rep:glob, topsecret should certainly not be visible to anyone even
when the department is moved to /departmentB.

As I said, I can not reproduce it programmatically but I am a bit
uneasy about that at the moment.

Regards,
 Markus

>
> Cheers,
> Alex
>
>
> --
> Alexander Klimetschek
> Developer // Adobe (Day) // Berlin - Basel
>
>
>