[
https://issues.apache.org/jira/browse/JSPWIKI-673?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18133134#comment-18133134
]
Arturo Bernal commented on JSPWIKI-673:
---------------------------------------
Reproduced on the current master with a test. I registered a page filter whose
preTranslate asks AuthorizationManager.checkPermission for the view permission
of the page being filtered, and rendered a page: the rendering ends with a
StackOverflowError, after 786 calls of the filter. The cause is as described in
the report. DefaultAclManager.getPermissions reads the ACL of a page by
rendering it, with plugins off, and the page filters run in that rendering. The
ACL of the page is only stored when the rendering ends, so the filter asks for
the same permissions again and getPermissions renders the page again. The pull
request 556 stops the repetition: while the ACL of a page is being read on a
thread, a new request for the same page on that thread gets an empty ACL. The
new test fails without the change and passes with it.
> Checking user permissions in a filter results in a loop
> -------------------------------------------------------
>
> Key: JSPWIKI-673
> URL: https://issues.apache.org/jira/browse/JSPWIKI-673
> Project: JSPWiki
> Issue Type: Bug
> Components: Authentication & Authorization
> Affects Versions: 2.8.3
> Environment: OSX, Tomcat 6
> Reporter: Alex Legler
> Priority: Major
> Labels: pull-request-available
>
> We're trying to determine whether a user has a certain permission in a filter
> using AuthorizationManager.checkPermission().
> Calling this method however causes an endless loop:
> It invokes DefaultAclManager.getPermissions() which tries to parse the page
> which in turn causes the filters to run.
> Stacktrace excerpt:
> ...
> at de.d3web.we.jspwiki.KnowWEPlugin.preTranslate(KnowWEPlugin.java:309)
> at
> com.ecyrd.jspwiki.filters.FilterManager.doPreTranslateFiltering(FilterManager.java:326)
> at com.ecyrd.jspwiki.WikiEngine.textToHTML(WikiEngine.java:1511)
> at com.ecyrd.jspwiki.WikiEngine.getHTML(WikiEngine.java:1455)
> at
> com.ecyrd.jspwiki.auth.acl.DefaultAclManager.getPermissions(DefaultAclManager.java:187)
> at
> com.ecyrd.jspwiki.auth.AuthorizationManager.checkPermission(AuthorizationManager.java:222)
> (more of our code, including the call to checkPermission())
> at de.d3web.we.jspwiki.KnowWEPlugin.preTranslate(KnowWEPlugin.java:309)
> at
> com.ecyrd.jspwiki.filters.FilterManager.doPreTranslateFiltering(FilterManager.java:326)
> at com.ecyrd.jspwiki.WikiEngine.textToHTML(WikiEngine.java:1511)
> at com.ecyrd.jspwiki.WikiEngine.getHTML(WikiEngine.java:1455)
> at
> com.ecyrd.jspwiki.auth.acl.DefaultAclManager.getPermissions(DefaultAclManager.java:187)
> at
> com.ecyrd.jspwiki.auth.AuthorizationManager.checkPermission(AuthorizationManager.java:222)
> ...
> The context used in DefaultAclManager.getPermissions() includes the following
> setting:
> ctx.setVariable( RenderingManager.VAR_EXECUTE_PLUGINS,
> Boolean.FALSE );
> Maybe filters can be disabled in a similar fashion (I think that would be
> setting PROP_RUNFILTERS to false as well)?
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
