arturobernalg opened a new pull request, #534: URL: https://github.com/apache/jspwiki/pull/534
https://issues.apache.org/jira/browse/JSPWIKI-1263 `GroupManager.removeGroup()` accepted the `Admin` group, so an administrator could delete the group that the security policy grants `AllPermission` and leave the wiki without administrators. `DefaultGroupManager.removeGroup()` now throws a `WikiSecurityException` when the local security policy grants `AllPermission` to the group. `DeleteGroup.jsp` already reports a `WikiSecurityException` as a failed operation, so the group stays and the user sees the error message. `GroupManagerTest.testRemoveGroupGrantedAllPermissionIsRejected` fails without the change (no exception is thrown) and passes with it. The `jspwiki-main` test suite passes (928 tests). I also checked it on Tomcat 10.1: after running the installer, confirming the deletion of `Admin` in `Group.jsp` shows "The operation failed" and the group is still listed and persisted. The container role `Admin` cannot be enumerated, so the rule is "a group granted `AllPermission` cannot be removed" rather than "at least one administrator remains". -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
