Uploaded image for project: 'Jackrabbit Oak'
  1. Jackrabbit Oak
  2. OAK-2933

AccessDenied when modifying transiently moved item with too many ACEs

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Closed
    • Major
    • Resolution: Fixed
    • 1.0.13
    • 1.0.15, 1.2.3, 1.3.0, 1.4
    • core
    • None

    Description

      If at least the following preconditions are fulfilled, saving a moved item fails with access denied:

      1. there are more PermissionEntries in the PermissionEntryCache than the configured EagerCacheSize
      2. an node is moved to a location where the user has write access through a group membership
      3. a property is added to the transiently moved item

      For example:
      1. set the eagerCacheSize to '0'
      2. create new group testgroup and user testuser
      3. make testuser member of testgroup
      4. create nodes /testroot/a and /testroot/a/b and /testroot/a/c
      5. allow testgroup rep:write on /testroot/a
      6. as testuser create /testroot/a/b/item (to verify that the user has write access)
      7. as testuser move /testroot/a/b/item to /testroot/a/c/item
      8. save() -> works
      9. as testuser move /testroot/a/c/item back to /testroot/a/b/item AND add new property to the transient /testroot/a/b/item
      10. save() -> access denied

      Attachments

        1. OAK-2933.patch
          2 kB
          Angela Schreiber
        2. OAK-2933_test.patch
          4 kB
          Angela Schreiber

        Activity

          People

            angela Angela Schreiber
            tripod Tobias Bocanegra
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: