[jboss-jira] [JBoss JIRA] Resolved: (JBPORTAL-1997) Couple of CMS Security issues

[Sohil Shah (JIRA)]

     [ http://jira.jboss.com/jira/browse/JBPORTAL-1997?page=all ]

Sohil Shah resolved JBPORTAL-1997.
----------------------------------

    Resolution: Done

> Couple of CMS Security issues
> -----------------------------
>
>                 Key: JBPORTAL-1997
>                 URL: http://jira.jboss.com/jira/browse/JBPORTAL-1997
>             Project: JBoss Portal
>          Issue Type: Bug
>      Security Level: Public(Everyone can see) 
>          Components: Portal CMS
>    Affects Versions: 2.6.4 Final
>            Reporter: Sohil Shah
>         Assigned To: Sohil Shah
>             Fix For: 2.6.5 Final
>
>
> The logic issue lies in the isPortletAccessible check in the CMSAdminPortlet. Side effects are:
> because of this check, the Portlet itself is unavailable even if the resources in the CMS are accessible as per the permissions set on the CMS. Behavior contradicts its setup
> usecases affected are:
> 1/ The CmsRootUser cannot access the CMS Admin tool. This completely defeats the purpose of the RootUser who should have all privileges to go in and fix things
> 2/ The CMSAdmin tool cannot be setup for access by Anonymous users

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira