Arturo Bernal created JSPWIKI-1355:
--------------------------------------
Summary: Search, UserPreferences and Workflow pages redirect to
the login page for every user
Key: JSPWIKI-1355
URL: https://issues.apache.org/jira/browse/JSPWIKI-1355
Project: JSPWiki
Issue Type: Bug
Reporter: Arturo Bernal
Fix For: 3.0.1
Since JSPWIKI-129 (commit 1b54e256c, 26 Oct 2026) the pages whose context needs
no permission are forbidden to every user.
The contexts without a permission of their own (prefs, find, workflow) return
the dummy permission PropertyPermission "os.name" "read"
(WikiContext.DUMMY_PERMISSION). Before that commit it passed, because
AccessController checked it against the policy of the JVM, which grants it. Now
only the policy of the wiki is consulted, nobody is granted it there, and
hasAccess denies it.
Measured on a running wiki (Tomcat 10.1 in Docker, default jspwiki.policy), a
war of master and a war of the parent of 1b54e256c:
|| Page || master || parent of 1b54e256c ||
| Search.jsp?query=test | 302 to Login.jsp | 200 |
| UserPreferences.jsp | 302 to Login.jsp | 200 |
| Workflow.jsp | 302 to Login.jsp | 200 |
| Login.jsp, Message.jsp, Wiki.jsp | 200 | 200 |
Also for a user that is logged in: UserPreferences.jsp shows Forbidden and the
log says "User ... has no access - forbidden
(permission=("java.util.PropertyPermission" "os.name" "read"))".
Proposed fix: DefaultAuthorizationManager.checkPermission allows
WikiContext.DUMMY_PERMISSION, which is what the contract of
Context.requiredPermission() says (no permission needed). A unit test that
creates the three contexts from their JSP and fails on master is included in
the fix.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
