DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG· RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT <http://issues.apache.org/bugzilla/show_bug.cgi?id=44120>. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND· INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=44120 Summary: Creating sibling doesn't take AC into account Product: Lenya Version: Trunk Platform: Other OS/Version: other Status: NEW Severity: normal Priority: P2 Component: Access Control AssignedTo: [email protected] ReportedBy: [EMAIL PROTECTED] If a user has permissions on a node to create pages (edit), they can create a new page as a sibling of that node, even if they don't have proper permissions on the parent. The page is then created as a sibling, and they don't have any permissions to the page. Since this can be seen as a way around the permission tree, they shouldn't be given permission to do so. When the sibling option is chosen, the permission check should be done against the parent. -- Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the assignee for the bug, or are watching the assignee. --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
