[SLING-7816] The GetAclServlet and GetEffectiveAclServlet components should be only mapped to the json extension

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: JCR Jackrabbit Access Manager 3.0.0
• Fix Version/s: JCR Jackrabbit Access Manager 3.0.2
• Assignee: Unassigned
• Reporter: Eric Norman
• Created: 08/Aug/18 17:49
• Updated: 20/Sep/19 11:34
• Resolved: 08/Aug/18 18:05

Description

The GetAclServlet and GetEffectiveAclServlet are missing the "sling.servlet.extensions=json" property which means that those servlets may get unintentionally mapped to other (non-json) file extensions.

This defect can prevent the developer from providing a custom libs/sling/servlet/default/acl.html script to provide an HTML view of the acl of a JCR node.

For example, without the missing "sling.servlet.extensions=json" property, a request to /node.acl.html may return the json response instead of the expected response from the acl.html script.