Details
-
Bug
-
Status: Closed
-
Major
-
Resolution: Fixed
-
JCR Jackrabbit Access Manager 2.0.2
-
None
Description
When calling the org.apache.sling.jcr.jackrabbit.accessmanager.PrivilegesInfo.canDelete(session, absPath) for a path with only one segment (i.e. a child of root), the value returned
is always false even if the current user does have permission to delete the node. It fails because the calculated parent path in this scenario resolves to an empty string instead of "/".
The attached patch fixes this edge condition.