[JCR-3492] versionHistory.addVersionLabel() fails with AccessDeniedException even when user has proper permission

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.5.2
• Component/s: jackrabbit-core, security, versioning
• Assignee: Unassigned
• Reporter: Amit Gupta
• Created: 17/Jan/13 05:34
• Updated: 03/Jun/16 10:31

Description

If a user does not have access to version store node and following operation fails with access denied
versionHistory.addVersionLabel(version.getName(), label, true);
16.01.2013 12:23:44.740 WARN [0:0:0:0:0:0:0:1 [1358319224592] GET /libs/dam/gui/content/assets/versioning/createversion.html HTTP/1.1] com.adobe.granite.asset.core.impl.AssetVersionManagerImpl Failed to add version label javax.jcr.AccessDeniedException: Access denied.
at org.apache.jackrabbit.core.security.DefaultAccessManager.checkPermission(DefaultAccessManager.java:193)
at org.apache.jackrabbit.core.version.VersionHistoryImpl.checkVersionManagementPermission(VersionHistoryImpl.java:311)
at org.apache.jackrabbit.core.version.VersionHistoryImpl.addVersionLabel(VersionHistoryImpl.java:172)

whereas the user have proper acl on the node that is being versioned. checkin and checkout operations are successful, it is just the addVersionlabel that fails.

Issue Links

• is related to: JCR-2963 Separate versioning API operations from accessibility of the version store exposed under /jcr:system/jcr:versionStorage