[gatein-issues] [JBoss JIRA] Commented: (GTNPORTAL-1137) Permission settings in application registry not preventing unauthorized access

[Trong Tran (JIRA)]

    [ https://jira.jboss.org/jira/browse/GTNPORTAL-1137?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12528052#action_12528052 ] 

Trong Tran commented on GTNPORTAL-1137:
---------------------------------------

currently the gadget's access permission does not prevent an user to add the gadget as a gadget into the dashboard page

> Permission settings in application registry not preventing unauthorized access
> ------------------------------------------------------------------------------
>
>                 Key: GTNPORTAL-1137
>                 URL: https://jira.jboss.org/jira/browse/GTNPORTAL-1137
>             Project: GateIn Portal
>          Issue Type: Bug
>      Security Level: Public(Everyone can see) 
>            Reporter: Matt Wringe
>            Assignee: Khoi Nguyen
>
> In the application registry, it possible to set access permission for portlets and gadgets, but this doesn't seem to work. I can change the permission of a portlet and still have an unauthorized user view its content.
> It does seem to prevent a user from viewing a gadget as a portlet on the dashboard page, but they can still add the gadget as a gadget to the dashboard page.
> Steps to reproduce:
> 1) log in as root
> 2) import a portlet through the application registry
> 3) set the premissions for the portlet
> 4) add the portlet to a page
> 5) logout and access the page
> 6) the unauthorized user can view the portlet
> expected results: the user shouldn't be able to see the portlet.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira