[OAK-842] Incorrect interaction of orderable child nodes with permission evaluation

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.17
• Component/s: core, security
• Assignee: Unassigned
• Reporter: Michael Dürig
• Created: 23/May/13 14:55
• Updated: 27/Feb/14 09:28
• Resolved: 06/Feb/14 16:13

Description

Working on OAK-813 revealed problems with the interaction of the current implementation of orderable nodes and access control:

• TreeImpl#getOrderedChildNames returns all child names regardless whether they are accessible in the current session or not. This might cause errors further down the line like exposure of the existence of child nodes.

• TreeImpl.remove doesn't (can't) update the child order property if the parent is not accessible.

Issue Links

• blocks: OAK-527 Implement Permission evaluation