[
https://issues.apache.org/jira/browse/JCR-3364?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13802177#comment-13802177
]
Jukka Zitting commented on JCR-3364:
------------------------------------
Instead of handling the cycle detection in transient space like done in
JCR-3291, I think it would be better to postpone the check to be done against
the ChangeLog instance in SharedItemStateManager.Update.begin(). I'll give it a
look.
> Moving of nodes requires read access to all parent nodes of the destination
> node
> --------------------------------------------------------------------------------
>
> Key: JCR-3364
> URL: https://issues.apache.org/jira/browse/JCR-3364
> Project: Jackrabbit Content Repository
> Issue Type: Bug
> Components: jackrabbit-core
> Affects Versions: 2.2.12, 2.4.2, 2.5
> Reporter: Thomas März
>
> Before JCR-3291 was fixed, Session#move(String, String) could move nodes
> without having read-access to the whole tree.
> - Deny jcr:read on /home and grant jcr:all on /home/users/usera to usera
> - Move nodes from /home/users/usera/from to /home/users/usera/to with usera's
> session
> - AccessDeniedException is thrown
> http://article.gmane.org/gmane.comp.apache.jackrabbit.user/18892
--
This message was sent by Atlassian JIRA
(v6.1#6144)
