Uploaded image for project: 'Jackrabbit Oak'
  1. Jackrabbit Oak
  2. OAK-10334

Node.addMixin() may overwrite existing mixins

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Closed
    • Major
    • Resolution: Fixed
    • None
    • 1.58.0
    • jcr

    Description

      A Session lacking permission to read property jcr:mixinTypes, but permission to write will overwrite existing mixins when calling Node.addMixin().

      The implementation does not check if the session has permission to read jcr:mixinTypes and assumes there are no existing values when the session does not have permission. The result is a jcr:mixinTypes property with only a single value passed to addMixin().

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. OAK-2441 Regression with Node.getPrimaryNodeType and getMixinNodeTypes wrt Jackrabbit 2.x

          • Major - Major loss of function.
          • Closed

          Improvement - An improvement or enhancement to an existing feature or task. OAK-10425 Ability to remove mixin type without read permission on jcr:mixinTypes property

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Open
          links to

          Web Link GitHub Pull Request #1011

          Activity

            People

              mreutegg Marcel Reutegger
              mreutegg Marcel Reutegger
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: