imo that is a bug

kind regards
angela

On 6/28/12 6:08 PM, Thomas März wrote:
Before JCR-3291 was fixed, Session#move(String, String) could move nodes
without having read-access to the whole tree.

- Deny jcr:read on /home and grant jcr:all on /home/users/usera to usera
- Move nodes from /home/users/usera/from to /home/users/usera/to with
usera's session
- AccessDeniedException is thrown

Is this by design or an oversight in JCR-3291?

Reply via email to