[OAK-8855] Permission evaluation of nodes broken after :nestedCug removed from parent node

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.8.7
• Fix Version/s: 1.26.0, 1.8.21, 1.22.1
• Component/s: authorization-cug
• Assignee: Angela Schreiber
• Reporter: Kunal Shubham
• Created: 14/Jan/20 08:45
• Updated: 12/Sep/23 09:00
• Resolved: 03/Feb/20 09:26

Description

Steps to Reproduce:

1. Create a node 'a' which has two children nodes 'b1' and 'b2'. The content tree looks as shown: /content/a/b1, /content/a/b2. Create two users user1 and user2.
2. Apply CUG policy on /content/a.
   • Authorize user1 and user2 to read /content/a.
   • Authorize user1 to read /content/a/b1.
   • Authorize user2 to read /content/a/b2.
3. Remove :nestedCugs property from /content/a/rep:cugPolicy.
4. Create a content session, login with user2. Try to read /content/a/b1.

Observed behavior : user2 is able to read /content/a/b1.

Expected behavior : user2 should not be able to read /content/a/b1 as it is unauthorized to do so.

Please note that :nestedCugs is removed by a mechanism which completely overwrites content tree below "/content/a".