[
https://issues.apache.org/jira/browse/SLING-4413?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14317931#comment-14317931
]
Felix Meschberger commented on SLING-4413:
------------------------------------------
[~ianeboston] This was the subject of an off-line discussion. It looks like the
{{:applyTo}} parameter can be an absolute path (which maybe is a problem as
well) and if handling this parmater yields an access problem hence exception,
this exception is not properly handled and a generic 500 error is thrown
instead of properly generating a 403/FORBIDDEN error.
If the root cause is a PersistenceException not providing more information, we
should be looking into how we can make sure to differentiate between a generic
write failure (e.g. data base connection lost or disk full) and an access
control issue.
> :applyTo should send 403 instead of 500 when operation fails
> -------------------------------------------------------------
>
> Key: SLING-4413
> URL: https://issues.apache.org/jira/browse/SLING-4413
> Project: Sling
> Issue Type: Bug
> Components: Servlets
> Affects Versions: Servlets Post 2.3.6
> Reporter: Lars Krapf
> Priority: Minor
>
> Example:
> curl -vv curl -F":operation=delete" -F":applyTo=/etc/*"
> http://localhost:4502/content/geometrixx
> Will give you a 500 (PersistenceException) in case /etc/* is not writable to
> the request session - as discussed with Felix & Carsten this should rather be
> a 403.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
