arturobernalg opened a new pull request, #588: URL: https://github.com/apache/jspwiki/pull/588
Since JSPWIKI-129 the contexts that need no permission (prefs, find, workflow) return the dummy permission `PropertyPermission "os.name" "read"`. It used to pass because the policy of the JVM grants it. Now only the policy of the wiki is consulted, which does not grant it, so `Search.jsp`, `UserPreferences.jsp` and `Workflow.jsp` were forbidden to every user, also to the ones that are logged in. `DefaultAuthorizationManager.checkPermission` now allows `WikiContext.DUMMY_PERMISSION`, which is what the contract of `Context.requiredPermission()` says. The constant is public for that. Measured on a running wiki (Tomcat 10.1, default policy): on master `Search.jsp?query=test`, `UserPreferences.jsp` and `Workflow.jsp` answer 302 to `Login.jsp`; with this change they answer 200, as the parent of the JSPWIKI-129 commit does. `Login.jsp`, `Message.jsp` and `Wiki.jsp` answer 200 in all three. Tests: `testContextsThatNeedNoPermission` creates the three contexts from their JSP; it fails on master and passes with the change. The whole jspwiki-main suite passes (1034 tests). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
