[JSPWIKI-1067] View-only ACLs are not enforced

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.10.3
• Fix Version/s: 2.10.4
• Component/s: Authentication & Authorization
• Assignee: Unassigned
• Reporter: Harvey Echain
• Created: 26/Mar/18 15:03
• Updated: 15/Nov/21 13:49
• Resolved: 30/Mar/18 20:29

Description

Group AllUsers being User1,User2

for a page that contains
[

{ALLOW view AllUsers}

]
[

{ALLOW edit User1}

]

when User2 displays this page for the first time, there is not 'Edit' button and he cannot edit the page (as intended).
Press reload, and 'Edit' button appears. User2 can now edit the page.

Issue Links

• is duplicated by: JSPWIKI-1039 ACLs are not taken into account when cache is disabled
• is duplicated by: JSPWIKI-1047 Access Control Lists do not work if page cache is deactivated