[jboss-jira] [JBoss JIRA] Created: (JBPORTAL-1465) move and copy commands jump the permissions

[Luca Stancapiano (JIRA)]

move and copy commands jump the permissions
-------------------------------------------

                 Key: JBPORTAL-1465
                 URL: http://jira.jboss.com/jira/browse/JBPORTAL-1465
             Project: JBoss Portal
          Issue Type: Bug
      Security Level: Public (Everyone can see)
          Components: Portal CMS
    Affects Versions: 2.6.Beta1
         Environment: eclipse , jboss as 4.0.5-cp4 and jboss portal taken from http://anonsvn.jboss.org/repos/portal/trunk
            Reporter: Luca Stancapiano
         Assigned To: Sohil Shah
             Fix For: 2.6 Final


When I log with an administrator different by "admin", I go into cms pannel of portal and I try to copy or move a file from a allowed space to a denied space, I have the error message that advise me that I haven't privileges to take that operation. But if I logout and then I enter again, I go into cms pannel and I see that my operation is succesfully done because the file is moved or copied anyway. Of course then I cannot to remove it because I've not permission in that zone. You can to test that operation moving default/support.html into / that ,in default, is allowed only to "admin" user. I've seen into the code that the permission access for copy and move operations is only for "from" path and there is no control for the "to" path Seeing method "hasManageAccess"  into org.jboss.portal.cms.impl.jcr.command.ACLEnforcer class there is:

        else if(command instanceof MoveCommand)
        {
            path = ((MoveCommand)command).msFromPath;
        }      

and the same thing for copy command.
I modified this part in this mode:

    	else if(command instanceof MoveCommand)
    	{
         
    	    path = ((MoveCommand)command).msFromPath;
    	    hasManageAccess = this.computeAccess(user,path,"manage");

    	    if (hasManageAccess) 
    	    {
    	        path = ((MoveCommand)command).msToPath;
    	        hasManageAccess = this.computeAccess(user,path,"manage");
    	    }

    	}

adding permission control for "to" path. It seems ok. May you try?

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira