[OAK-5931] Inconsistent behaviour when removing nodes with rep:policy subnodes for users without modify ACL permissions

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Not A Bug
• Affects Version/s: 1.4.14, 1.6.1
• Component/s: core
• Assignee: Angela Schreiber
• Reporter: Tom Blackford
• Created: 14/Mar/17 21:41
• Updated: 19/Apr/17 13:56
• Resolved: 19/Apr/17 13:55

Description

If a session (without rep:modifyAccessControl) removes a node with a rep:policy subnode and then recreates it within the same save (without the rep:policy subnode) the commit diff will mistake the action for the removal of the ACL, which this session is not authorised to do.

If the session is saved prior to recreating the node, both saves (after remove and after recreate) will succeed.

From discussion with angela:

the diff mechanism used within Root.commit cannot distinguish between the removal of a policy or the replace of the access controlled node with one that doesn't have the policy set. within that diff it looks like the removal of the policy node