jcr:nodeTypeManagement necessary for addNode("name", "type")?
-------------------------------------------------------------
Key: JCR-2754
URL: https://issues.apache.org/jira/browse/JCR-2754
Project: Jackrabbit Content Repository
Issue Type: Improvement
Components: jackrabbit-core, security
Affects Versions: 2.1.1, 2.1.0, 2.0.0
Reporter: Jukka Zitting
Priority: Minor
Our current implementation of addNode("name", "type") requires the
jcr:nodeTypeManagement permission, that's defined by JSR 283 as the "privilege
to add and remove mixin node types and change the primary node type of a node".
In a private discussion this implementation was questioned, based on the
argument that the spec seems to only refer to "changing" the primary type, not
specifying it during creation.
Personally I don't care too much either way, and since the only harm done by
the current implementation seems to be some confusion, I'd rather not change
the implementation to prevent backwards compatibility issues.
Anyway, I'm filing this issue to solicit feedback from the community. If the
consensus is that addNode("name", "type") shouldn't need the
jcr:nodeTypeManagement permission, then we should clarify the spec in JSR 333
and make this change in Jackrabbit 3.0. Otherwise we'll just resolve this issue
as Won't Fix.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
