[
https://issues.apache.org/jira/browse/JSPWIKI-1355?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18139961#comment-18139961
]
ASF subversion and git services commented on JSPWIKI-1355:
----------------------------------------------------------
Commit a897470651d67df8ddc0fc60261388e93b65310f in jspwiki's branch
refs/heads/master from spyhunter99
[ https://gitbox.apache.org/repos/asf?p=jspwiki.git;h=a89747065 ]
Merge pull request #588 from arturobernalg/bug/JSPWIKI-1355
JSPWIKI-1355 Allow the contexts that need no permission
> Search, UserPreferences and Workflow pages redirect to the login page for
> every user
> ------------------------------------------------------------------------------------
>
> Key: JSPWIKI-1355
> URL: https://issues.apache.org/jira/browse/JSPWIKI-1355
> Project: JSPWiki
> Issue Type: Bug
> Reporter: Arturo Bernal
> Priority: Major
> Labels: pull-request-available
> Fix For: 3.0.1
>
>
> Since JSPWIKI-129 (commit 1b54e256c, 26 Oct 2026) the pages whose context
> needs no permission are forbidden to every user.
> The contexts without a permission of their own (prefs, find, workflow) return
> the dummy permission PropertyPermission "os.name" "read"
> (WikiContext.DUMMY_PERMISSION). Before that commit it passed, because
> AccessController checked it against the policy of the JVM, which grants it.
> Now only the policy of the wiki is consulted, nobody is granted it there, and
> hasAccess denies it.
> Measured on a running wiki (Tomcat 10.1 in Docker, default jspwiki.policy), a
> war of master and a war of the parent of 1b54e256c:
> || Page || master || parent of 1b54e256c ||
> | Search.jsp?query=test | 302 to Login.jsp | 200 |
> | UserPreferences.jsp | 302 to Login.jsp | 200 |
> | Workflow.jsp | 302 to Login.jsp | 200 |
> | Login.jsp, Message.jsp, Wiki.jsp | 200 | 200 |
> Also for a user that is logged in: UserPreferences.jsp shows Forbidden and
> the log says "User ... has no access - forbidden
> (permission=("java.util.PropertyPermission" "os.name" "read"))".
> Proposed fix: DefaultAuthorizationManager.checkPermission allows
> WikiContext.DUMMY_PERMISSION, which is what the contract of
> Context.requiredPermission() says (no permission needed). A unit test that
> creates the three contexts from their JSP and fails on master is included in
> the fix.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
