[
https://issues.apache.org/jira/browse/OAK-3324?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14730754#comment-14730754
]
Tobias Bocanegra commented on OAK-3324:
---------------------------------------
improved test in r1701241.
the problem is indeed that the parent ACL is read for the REMOVE_NODE
permission.
when testing a permission that does not require the parent node ACL, like
MODIFY_PROPERTY it works.
see
org.apache.jackrabbit.oak.security.authorization.restriction.CustomRestrictionProviderTest#testProtectByRestriction
> Evaluation with restriction is not consistent with parent ACLs
> --------------------------------------------------------------
>
> Key: OAK-3324
> URL: https://issues.apache.org/jira/browse/OAK-3324
> Project: Jackrabbit Oak
> Issue Type: Bug
> Components: security
> Affects Versions: 1.3.4
> Reporter: Tobias Bocanegra
> Assignee: Tobias Bocanegra
>
> consider the following ACL setup:
> {noformat}
> testuser allow rep:read,rep:write /testroot
> testuser deny jcr:removeNode /testroot/a glob=*/c
> testuser allow jcr:removeNode /testroot/a glob=*/b
> {noformat}
> now: {{hasPermission(/tesroot/a/b/c, jcr:removeNode) == false}} but the user
> is still able to delete the node.
> * if we change the order of the ACEs with the restriction, it works (i.e. the
> user can't delete)
> * if we use direct ACLs on the respective nodes, it works
> I think this is a bug...but I'm not sure if {{hasPermission}} is wrong, or
> the check during node deletion.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
