[
https://issues.apache.org/jira/browse/JSPWIKI-1355?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18139958#comment-18139958
]
ASF subversion and git services commented on JSPWIKI-1355:
----------------------------------------------------------
Commit c4e13a7c6c75135a226a1e751a2527bb3c6c34b1 in jspwiki's branch
refs/heads/master from Arturo Bernal
[ https://gitbox.apache.org/repos/asf?p=jspwiki.git;h=c4e13a7c6 ]
JSPWIKI-1355 Allow the contexts that need no permission
Since JSPWIKI-129 the dummy permission that a context without a permission
returns is checked against the policy of the wiki only, which does not grant
it, so Search.jsp, UserPreferences.jsp and Workflow.jsp were forbidden to every
user. The authorization manager now allows it, as the contract of
Context.requiredPermission() says.
> Search, UserPreferences and Workflow pages redirect to the login page for
> every user
> ------------------------------------------------------------------------------------
>
> Key: JSPWIKI-1355
> URL: https://issues.apache.org/jira/browse/JSPWIKI-1355
> Project: JSPWiki
> Issue Type: Bug
> Reporter: Arturo Bernal
> Priority: Major
> Labels: pull-request-available
> Fix For: 3.0.1
>
>
> Since JSPWIKI-129 (commit 1b54e256c, 26 Oct 2026) the pages whose context
> needs no permission are forbidden to every user.
> The contexts without a permission of their own (prefs, find, workflow) return
> the dummy permission PropertyPermission "os.name" "read"
> (WikiContext.DUMMY_PERMISSION). Before that commit it passed, because
> AccessController checked it against the policy of the JVM, which grants it.
> Now only the policy of the wiki is consulted, nobody is granted it there, and
> hasAccess denies it.
> Measured on a running wiki (Tomcat 10.1 in Docker, default jspwiki.policy), a
> war of master and a war of the parent of 1b54e256c:
> || Page || master || parent of 1b54e256c ||
> | Search.jsp?query=test | 302 to Login.jsp | 200 |
> | UserPreferences.jsp | 302 to Login.jsp | 200 |
> | Workflow.jsp | 302 to Login.jsp | 200 |
> | Login.jsp, Message.jsp, Wiki.jsp | 200 | 200 |
> Also for a user that is logged in: UserPreferences.jsp shows Forbidden and
> the log says "User ... has no access - forbidden
> (permission=("java.util.PropertyPermission" "os.name" "read"))".
> Proposed fix: DefaultAuthorizationManager.checkPermission allows
> WikiContext.DUMMY_PERMISSION, which is what the contract of
> Context.requiredPermission() says (no permission needed). A unit test that
> creates the three contexts from their JSP and fails on master is included in
> the fix.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
