Mailing-List: contact dev-help@manifoldcf.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@manifoldcf.apache.org
Date: Thu, 6 Apr 2017 22:26:41 +0000 (UTC)
From: "Karl Wright (JIRA)" <jira@apache.org>
To: dev@manifoldcf.apache.org
Message-ID: <JIRA.13062260.1491515478000.230242.1491517601549@Atlassian.JIRA>
In-Reply-To: <JIRA.13062260.1491515478000@Atlassian.JIRA>
References: <JIRA.13062260.1491515478000@Atlassian.JIRA> <JIRA.13062260.1491515478716@jira-lw-us.apache.org>
Subject: [jira] [Updated] (CONNECTORS-1401) Documentum Authority does not
 properly exclude ACLs that include negative groups or users
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Thu, 06 Apr 2017 22:26:45 -0000


     [ https://issues.apache.org/jira/browse/CONNECTORS-1401?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Karl Wright updated CONNECTORS-1401:
------------------------------------
    Description: 
The Documentum Authority currently returns a list of ACL names, which it gets using the following DQL query:

{code}
SELECT DISTINCT A.owner_name, A.object_name FROM dm_acl A WHERE
            A.object_name NOT LIKE 'dm_%' AND (
            (any (A.r_accessor_name IN ('" + strAccessToken + "', 'dm_world') AND r_accessor_permit>2)
            OR (any (A.r_accessor_name='dm_owner' AND A.r_accessor_permit>2) AND A.owner_name=" + quoteDQLString(strAccessToken) + ")
            OR (ANY (A.r_accessor_name in (SELECT G.group_name FROM dm_group G WHERE ANY G.i_all_users_names = " + quoteDQLString(strAccessToken) + ")
            AND r_accessor_permit>2)) )
{code}

The query should be modified to block all ACLs that have r_accessor_permit <= 2, since those are "denied" access.


  was:
The Documentum Authority currently returns a list of ACL names, which it gets using the following DQL query:

{code}
ELECT DISTINCT A.owner_name, A.object_name FROM dm_acl A WHERE
            A.object_name NOT LIKE 'dm_%' AND (
            (any (A.r_accessor_name IN ('" + strAccessToken + "', 'dm_world') AND r_accessor_permit>2)
            OR (any (A.r_accessor_name='dm_owner' AND A.r_accessor_permit>2) AND A.owner_name=" + quoteDQLString(strAccessToken) + ")
            OR (ANY (A.r_accessor_name in (SELECT G.group_name FROM dm_group G WHERE ANY G.i_all_users_names = " + quoteDQLString(strAccessToken) + ")
            AND r_accessor_permit>2)) )
{code}

The query should be modified to block all ACLs that have r_accessor_permit <= 2, since those are "denied" access.


> Documentum Authority does not properly exclude ACLs that include negative groups or users
> -----------------------------------------------------------------------------------------
>
>                 Key: CONNECTORS-1401
>                 URL: https://issues.apache.org/jira/browse/CONNECTORS-1401
>             Project: ManifoldCF
>          Issue Type: Bug
>          Components: Documentum connector
>    Affects Versions: ManifoldCF 2.5
>            Reporter: Karl Wright
>            Assignee: Karl Wright
>             Fix For: ManifoldCF 2.7
>
>
> The Documentum Authority currently returns a list of ACL names, which it gets using the following DQL query:
> {code}
> SELECT DISTINCT A.owner_name, A.object_name FROM dm_acl A WHERE
>             A.object_name NOT LIKE 'dm_%' AND (
>             (any (A.r_accessor_name IN ('" + strAccessToken + "', 'dm_world') AND r_accessor_permit>2)
>             OR (any (A.r_accessor_name='dm_owner' AND A.r_accessor_permit>2) AND A.owner_name=" + quoteDQLString(strAccessToken) + ")
>             OR (ANY (A.r_accessor_name in (SELECT G.group_name FROM dm_group G WHERE ANY G.i_all_users_names = " + quoteDQLString(strAccessToken) + ")
>             AND r_accessor_permit>2)) )
> {code}
> The query should be modified to block all ACLs that have r_accessor_permit <= 2, since those are "denied" access.


--
This message was sent by Atlassian JIRA
(v6.3.15#6346)