[
https://issues.apache.org/jira/browse/JSPWIKI-603?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18134357#comment-18134357
]
Arturo Bernal commented on JSPWIKI-603:
---------------------------------------
Checked in the current code (upstream master) and on a running instance (Tomcat
10.1).
The hooks of PageFilter are preTranslate and postTranslate, which run when a
page is rendered, and preSave and postSave; none is called when the editor is
opened. Edit.jsp reads the text of the editor with EditorManager.getEditedText
and PageManager.getText, which return the stored text without going through the
filters. So a filter that replaces the content when the page is shown cannot
change what the editor shows. As far as I can see this is how it is designed,
and it matches the report: the substitution works in view mode and not in the
editor.
For what the report wants, deciding who may view or edit each page, the
permission checks are the place, and they cover both tabs. On a page with the
ACL ALLOW view Admin, an anonymous request for the page and an anonymous
request for its editor were both answered with a redirect to the login page
(HTTP 302), so the content was not shown in either. To allow viewing but not
editing, an ACL with only the edit permission restricted should do it, and a
decision made by an external component could go in a custom authorizer
(jspwiki.authorizer) or in the security policy; I did not try those two.
Limits: I did not write a filter to run the exact scenario; I read the code and
tried the ACL for viewing. Leaving the issue open for the reporter or a
maintainer to close as by design.
> When in edit mode and the pagefilters are called, the modified String is
> ignored and the original text is loaded
> ----------------------------------------------------------------------------------------------------------------
>
> Key: JSPWIKI-603
> URL: https://issues.apache.org/jira/browse/JSPWIKI-603
> Project: JSPWiki
> Issue Type: Bug
> Components: Filters
> Affects Versions: 2.8.2
> Environment: Tomcat on XP
> Reporter: Hany Salem
> Priority: Major
>
> Ok, now what I am doing may be the complete wrong way of solving my problem,
> however, I don't know of an easier way, then I ran into this problem.
> For security, we would like some pages to be visible/edit to some users but
> not for others. That is User A can edit page 1 but only view page 2 and also
> not even have view access for page 3. The runtime will figure that by
> calling an external component. So basically through a page filter like e.g.
> Spam, I extended BasicPageFilter and analyze the logged in user and page and
> decide at that time, e.g. no access, view, edit. If no access I replace the
> page contents with a String "User xxxx is not ahtorized to view this page".
> This works great from the PageFilter.
> The bad part is the the edit tab is still there and if that same user who did
> NOT have view access clicks it, then the editor box is displayed and my
> substitutions of the page contents are ignored. This is despite the filter
> being called in view mode to populate the edit pane...
> How come ? Seems like a problem.... Maybe I am missing something.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
