[JSPWIKI-702] Auth: Users only with modify permission may create pages

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Duplicate
• Affects Version/s: 2.8.3, 2.8.4
• Component/s: Authentication & Authorization
• Assignee: Unassigned
• Reporter: Florian Holeczek
• Created: 29/Aug/11 06:44
• Updated: 18/Sep/11 15:25
• Resolved: 18/Sep/11 15:25

Description

grant principal com.ecyrd.jspwiki.auth.authorize.Role "Anonymous" {
permission com.ecyrd.jspwiki.auth.permissions.PagePermission ":", "modify";
// permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*", "createPages";
};

With these settings, Anonymous may create pages!

grant principal com.ecyrd.jspwiki.auth.authorize.Role "Anonymous" {
// permission com.ecyrd.jspwiki.auth.permissions.PagePermission ":", "modify";
// permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*", "createPages";
};

Works as it should: Anonymous may neither create nor modify pages.

grant principal com.ecyrd.jspwiki.auth.authorize.Role "Anonymous" {
// permission com.ecyrd.jspwiki.auth.permissions.PagePermission ":", "modify";
permission com.ecyrd.jspwiki.auth.permissions.WikiPermission "*", "createPages";
};

Well, since there isn't any possibility of creating a page without editing it AFAIK, this setting also seems to work as it should: Seems to be the same like the second case.

The changes listed above are the only changes I did to the file I checked out from the svn repository.

Issue Links

• duplicates: JSPWIKI-626 The "createPages" WikiPemission is not properly implemented